How to update Site collection audit settings for SharePoint online with Powershell

How to update Site collection audit settings for SharePoint online with document library ?


Prerequisite 1 : Install SharePoint Online Management Shell (Google term if below link breaks)
https://www.microsoft.com/en-us/download/details.aspx?id=35588

FYI : AuditMaskType enumeration : https://docs.microsoft.com/en-us/previous-versions/office/sharepoint-server/mt125231(v=office.15)

ID	Microsoft.SharePoint. Client.AuditMaskType	Enum Value	UI Options
1	All	-1	Not available from UI
2	CheckIn	2	Checking out or checking in items
3	CheckOut	1	Checking out or checking in items
4	ChildDelete	64	Not available from UI
5	Copy	2048	Moving or copying items to another location in the site
6	ObjectDelete	8	Deleting or restoring items
7	Move	4096	Moving or copying items to another location in the site
8	None	0	Not available from UI
9	ProfileChange	32	Editing content types and columns
10	SchemaChange	128	Editing content types and columns
11	Search	8192	Searching site content
12	SecurityChange	256	Editing users and permissions
13	Undelete	512	Deleting or restoring items
14	Update	16	Editing items
15	View	4	Not available from UI
16	Workflow	1024	Not available from UI

PowerShell Script



#Config Items
$AdminUrl = "https://domain-admin.sharepoint.com"
$SiteUrl = "https://doman.sharepoint.com/sites/POCTest2"
$Username = "fname.lname@domain.com"

write-host "Calling Connect-SPOService with admin URL : " + $AdminUrl + " . You will be prompted for uname and pw."
Connect-SPOService -Url $AdminUrl
write-host "Script is using user name as : " + $Username
 #OLD LOGIC - Issue : password is visible on screen
 #$Password = Read-Host -Prompt "Enter the password"
 #$SecurePassword = ConvertTo-SecureString $Password -AsPlainText -Force

$SecurePassword = Read-Host -Prompt "Enter the password for " + $Username -AsSecureString
##########################################################################
# Connect to site
$ClientContext = New-Object Microsoft.SharePoint.Client.ClientContext($SiteUrl)
$credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($UserName, $SecurePassword)
$ClientContext.Credentials = $credentials
$spoSite = $ClientContext.Site
$ClientContext.Load($spoSite)
$spoSiteAudit = $spoSite.Audit
$ClientContext.Load($spoSiteAudit)
$ClientContext.ExecuteQuery()
write-host "Current audit flag # is : " + $spoSiteAudit.AuditFlags
#Flags (Add more flags as required)
$Copy = [Microsoft.SharePoint.Client.AuditMaskType]::Copy;
$ObjectDelete  = [Microsoft.SharePoint.Client.AuditMaskType]::ObjectDelete;
$Move = [Microsoft.SharePoint.Client.AuditMaskType]::Move;
$ProfileChange = [Microsoft.SharePoint.Client.AuditMaskType]::ProfileChange;
$SchemaChange = [Microsoft.SharePoint.Client.AuditMaskType]::SchemaChange;
$SecurityChange = [Microsoft.SharePoint.Client.AuditMaskType]::SecurityChange;
$Undelete = [Microsoft.SharePoint.Client.AuditMaskType]::Undelete;

$ClientContext.Site.Audit.AuditFlags = $Copy,$ObjectDelete,$Move ,$ProfileChange, $SchemaChange, $SecurityChange, $Undelete
$ClientContext.Site.Audit.Update();
$spoSite.RootWeb.AllProperties["_auditlogreportstoragelocation"] = "/sites/POCTest2/Shared%20Documents";
$spoSite.RootWeb.Update();
$ClientContext.Load($spoSite);
$ClientContext.Load($spoSite.RootWeb);
$ClientContext.Load($spoSite.RootWeb.AllProperties);
$ClientContext.ExecuteQuery();