Reference:
https://servicetrust.microsoft.com/ViewPage/TrustDocumentsV3?docTab=7f51cb60-3d6c-11e9-b2af-7bb9f5d2d913_FAQ_and_White_Papers
https://docs.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-auditing-and-reporting-overview?view=o365-worldwide Microsoft cloud services include several auditing and reporting features you can use to track user and administrative activity within their tenant, Examples include changes made to Exchange Online and SharePoint Online tenant configuration settings, and changes made by users to documents and other items. You can use audit information and reports available in Microsoft cloud services to more effectively manage user experience, mitigate risks, and fulfill compliance obligations.
Security & Compliance Centers
The Microsoft 365 Security & Compliance Center, Microsoft 365 Security Center, and Microsoft 365 Compliance Center are one-stop portals for protecting data in your organization, and they include many auditing and reporting features. These centers help you with your data protection or compliance needs and audit user and administrator activity. You can access these centers using your subscription admin account.

Reference:
https://docs.microsoft.com/en-us/microsoft-365/business/get-microsoft-365-business
https://www.microsoft.com/en-us/licensing/licensing-programs/enterprise?activetab=enterprise-tab%3aprimaryr2