The following table describes the properties that are included (depending on the service in which an event occurs) in the multi-property AuditData column.
Each of the property: value pairs in this multi-value property are separated by a comma.
This column contains a multi-value property for multiple properties from the audit log record. This file contains additional information from each audit record in a column named AuditData. When your export all results for an audit log search, the raw data from the unified audit log is copied to a comma-separated value (CSV) file that is downloaded to your local computer. For more information, see Search the audit log.
You do this by selecting Export results > Download all results on the Audit log search page. When you export the results of an audit log search from the Microsoft 365 compliance center, you have the option to download all the results that meet your search criteria.
