SharePoint Audit Log: How to Track User Activity and Files 

A project manager opens a SharePoint document only to find that important information has changed. The team cannot identify who made the changes, whether someone downloaded the file, or when the activity occurred. Without a clear record of user actions, even a simple document investigation can turn into hours of checking emails, asking team members, and reviewing file versions. 

A SharePoint audit log helps administrators investigate these situations by showing who accessed, modified, downloaded, shared, or deleted files. Instead of relying on assumptions, teams can examine recorded activities and trace actions back to specific user accounts. 

Through our work with SharePoint administration, document management, and access permissions, we have seen that teams often struggle to distinguish between what version history shows and what audit records can reveal. Knowing where to find the right information makes it easier to investigate file activity without unnecessary guesswork. 

In this article, you will learn how to access the SharePoint audit log, track user activity, investigate file changes, export activity reports, and resolve common audit logging issues. 

How to Access SharePoint Audit Logs in Microsoft 365 

Microsoft provides access to SharePoint audit records through the Microsoft Purview portal. Administrators can search these records to investigate activity across SharePoint sites and document libraries. 

Step 1: Check Audit Log Permissions 

Before accessing the audit records, confirm that your account has the required permissions. 

Microsoft Purview uses two important audit-related roles:

• Audit Reader: Allows users to search and export audit records without managing audit settings.
• Audit Manager: Allows users to search and export records and manage auditing settings.

You can check these permissions under Settings > Roles and scopes > Role groups in Microsoft Purview.

Step 2: Open Microsoft Purview 

Follow these steps to access the audit search tool:

1. Sign in to Microsoft Purview.
2. Open Solutions > Audit or select Audit from the available solution cards.
3. Navigate to the Search page.
4. Choose the date range for the activity you want to investigate.
5. Select the relevant SharePoint activities and apply additional filters.

Microsoft Purview uses Coordinated Universal Time (UTC) for audit searches. Therefore, consider time zone differences when investigating activities reported in local time.

Step 3: Search and Review Audit Records 

After selecting the filters, click Search. 

Microsoft Purview starts a search job and displays matching records once the search is complete. Open an individual record to examine the available details, including the activity, user account, timestamp, and affected resource. 

This information helps administrators move from a general complaint about a document to a more focused investigation.  

How to Track User Activity in SharePoint 

To track user activity in SharePoint, administrators should filter audit records by user, activity type, and date. This approach helps identify what a particular account did without reviewing unrelated events. 

Track Actions Performed by a Specific User 

Open Microsoft Purview Audit and enter the user’s account in the Users filter. 

Next, choose the relevant date range and select SharePoint activities such as file access, modification, deletion, or download. 

The resulting SharePoint activity log helps answer questions such as:

• Which files did the user access?
• Did the user download or delete any documents?
• What changes did the user make during the selected period?

One common issue we see during SharePoint audits is that multiple users work on the same documents, making it difficult to identify who performed a specific action. Filtering the audit records by user account helps narrow down the activity and makes it easier to trace changes to the right person.

However, administrators should examine the actual event details rather than assume every recorded action represents an intentional change. 

Track Activity Across a SharePoint Site 

Sometimes, an investigation concerns an entire site rather than one user. 

In this case, enter the SharePoint site URL in the File, folder, or site filter. Leave the Users field empty to include activities from different accounts. 

You can then narrow the search by selecting relevant operations. 

This approach works particularly well when several employees collaborate on the same document library and administrators need to identify which account performed a particular action. 

How to Track File Access, Changes, and Downloads 

File-level investigations require more precise filters because one document can generate several different audit events. 

The SharePoint audit log records various file operations, allowing administrators to distinguish between access, modification, deletion, and other actions. 

Common SharePoint Audit Log Activities 

Microsoft documents these operations as part of its SharePoint and OneDrive audit activities.  

Find Who Accessed or Downloaded a File 

To investigate a particular document, enter its name or URL in the file filter. 

Next, select the relevant activities, such as Accessed file or Downloaded file, and run the search. 

Review the resulting records to identify the accounts associated with those operations. 

Remember that a file-access event does not automatically prove that someone read its contents. Also, Microsoft may suppress repeated access events for the same user and file within a short period. 

Identify Who Modified or Deleted a Document 

When a document changes unexpectedly, search for FileModified or FileDeleted events. 

Open the matching records and examine the account, timestamp, and file location. 

Next, compare the findings with SharePoint version history when available. Version history helps identify document revisions, while audit records provide additional information about recorded activities. 

Together, these records offer a clearer picture of what happened without treating a modification event as proof of which specific content changed. 

How to Generate a SharePoint File Activity Report 

Administrators can create a SharePoint file activity report by exporting audit search results. 

This becomes useful when an investigation involves multiple files, accounts, or dates. 

Export Audit Records to CSV 

Follow these steps:

1. Open the completed search in Microsoft Purview Audit.
2. Review the matching activity records.
3. Select the available export option to download the results as a CSV file.
4. Open the exported file in Microsoft Excel.
5. Filter the records by account, operation, date, or file location.

Exported audit data may include detailed information inside an AuditData field. Excel Power Query can help separate these properties into individual columns for easier analysis.

Keeping separate reports for different sites or date ranges makes audit records easier to review.

SharePoint Audit Log vs. Site Usage Reports 

Administrators sometimes confuse audit logs with SharePoint usage reports. However, these tools answer different questions. 

Use audit logs when you need to investigate a specific user or file action. Use site usage reports when you need broader information about site activity.  

SharePoint Audit Log Retention and Limitations 

Audit records remain available only within the retention period supported by your organization’s licensing and policies. 

Microsoft Purview Audit (Standard) generally retains audit records for 180 days. 

Eligible Audit (Premium) licensing supports one-year default retention for SharePoint audit activity, with additional retention options available through applicable policies and licensing. 

However, the audit search interface limits an individual search to a maximum 180-day date range. Longer investigations may require multiple searches. 

Another important limitation involves processing delays. 

Microsoft states that audit records for core Microsoft 365 services typically become available within 60–90 minutes, although some records take longer. 

Therefore, a missing event immediately after an action does not necessarily indicate that auditing failed.  

Why SharePoint Audit Logs May Not Show User Activity 

When a SharePoint audit search returns no results, administrators should check the search configuration before assuming the activity never happened. 

Audit Logging Is Not Enabled 

Microsoft enables auditing by default for many enterprise subscriptions. However, some Microsoft 365 Business subscriptions require administrators to enable auditing. 

Check the organization’s auditing status if searches consistently return no records. 

Search Filters Are Too Restrictive 

An incorrect username, file path, activity type, or date range can exclude relevant records. 

First, broaden the search. Then, add filters individually until you identify the required events. 

Audit Records Have Expired 

Records outside the applicable retention period may no longer be searchable. 

Check the user’s licensing and any configured audit retention policies before investigating older incidents. 

Audit Events Have Not Appeared Yet 

New activities may take time to reach the audit log. 

If an event occurred recently, repeat the search after allowing sufficient processing time. 

For continuing problems, check Microsoft 365 service health and verify that the selected activities support auditing. 

Best Practices for Monitoring SharePoint User Activity 

Effective audit monitoring starts with focused investigations rather than collecting every available record. 

Review high-risk activities such as confidential file downloads, unexpected deletions, and changes to external sharing permissions. 

For sensitive document libraries, establish clear procedures for identifying which accounts performed actions and how administrators should document findings. 

Also, restrict audit access to authorized personnel. Audit records may contain user identifiers, file locations, and other sensitive operational details. 

Finally, review retention requirements before an incident occurs. Organizations that need longer historical records should assess whether their licensing and audit retention policies support that requirement. 

Get Better Visibility Into SharePoint Activity With Code Creators 

Tracking SharePoint activity becomes difficult when audit records contain hundreds of events and administrators cannot easily identify the actions that matter. Finding the right information requires more than running a search. It also involves understanding audit permissions, activity types, and retention settings. 

Code Creators helps organizations manage these challenges as part of its SharePoint managed services, covering everything from audit log configuration to user activity monitoring. Our team works with businesses to improve visibility into document access, file changes, and sharing activities while keeping security and compliance requirements in mind. 

Need a clearer picture of who is accessing and changing your SharePoint files? Book a consultation with us to review your current audit setup and identify where your activity tracking needs improvement. 

Conclusion 

The SharePoint audit log provides a reliable starting point for investigating user activity, document changes, downloads, deletions, and sharing events. 

For accurate results, administrators should select the correct activity types, narrow searches by user or file location, and inspect individual audit records. Exporting results to CSV also makes it easier to compare activity across multiple accounts and documents. 

However, audit logs have important boundaries. File access does not always prove that someone read a document, records may take time to appear, and retention depends on licensing and policies. 

Combining audit searches with version history and appropriate access controls helps organizations investigate SharePoint incidents more accurately while maintaining clear records of user activity. 

Still finding it difficult to trace file changes or investigate unusual activity in SharePoint? Code Creators can help you identify what’s missing from your current tracking process and address the issues that make audit investigations difficult. Get in touch with our team to discuss the SharePoint challenges you’re facing.