Once you have onboarded an Office 365 suite with applications, you must turn on audit logging in your Microsoft 365 account before you can search the audit log. Event polling will start 24 hours after audit logging is enabled.

For information and instructions regarding about audit logging for Microsoft 365, see the following Microsoft documentation:

https://docs.microsoft.com/en-us/microsoft-365/compliance/turn-audit-log-search

-on-or-off?view=o365-worldwide

Also, verify that management of mailboxes by default is enabled. Microsoft now turns on mailbox audit logging by default. For information and instructions about managing mailbox auditing, see the following Microsoft documentation.

https://docs.microsoft.com/en-us/microsoft-365/compliance/enable-mailbox-auditi ng?view=o365-worldwide