How to Audit User Activity in SharePoint Online – IT Solver Support

This guide explains how to track user actions, such as file access or downloads, in SharePoint Online using the Microsoft Purview audit log. This is useful for monitoring activity, ensuring compliance, or investigating specific user behaviour on your SharePoint sites.

Overview

The Microsoft Purview audit log records user and admin activities across SharePoint Online, including file views, downloads, and modifications. By searching the audit log in the Microsoft Purview portal, you can identify actions performed by specific users or on specific files, helping you maintain security and oversight.

Prerequisites

Microsoft 365 Global Administrator or Compliance Administrator permissions.
Audit logging enabled in your Microsoft 365 tenant (enabled by default for most E3 and E5 plans).
Access to the Microsoft Purview portal.
User email address or display name of the individual whose activity you’re auditing.

How to Check User Activity in SharePoint

Sign in to the Microsoft Purview Portal: Go to the Microsoft Purview portal and sign in with your admin credentials.

Ensure you have Global Administrator or Compliance Administrator permissions to access audit logs.
Access the Audit Log: In the Microsoft Purview portal, either type "Audit" in the search bar at the top and select it from the results, or navigate to Solutions All solutions Core Audit.
Create a New Audit Search: Click New search or Audit log search. Configure the search with the following details:
- Activities: Select File and folder activities to include actions like "Accessed file," "Downloaded file," or "Modified file." Optionally, choose specific activities for precision.
- Date range: Choose a time period (e.g., last 7, 30, or 90 days). Audit data is retained for 90 days (or up to 1 year with premium licenses).
- Users: Enter the email address or display name of the user whose activity you’re tracking (e.g., user@yourdomain.com).
- File, folder, or site: Optionally, specify a file name or SharePoint site URL to narrow results.
If you leave the user field blank, the search will include all users, which may return a large number of results.
Run the Search: Click Search to retrieve results. The results will list activities matching your criteria, such as:
- Accessed file: The user viewed or opened a file.
- Downloaded file: The user downloaded a file.
- Modified file: The user edited a file.
Review Details: Click an event to view specifics, including the file name, site URL, timestamp, and IP address. The Object ID field shows the file’s path in SharePoint.

You can export results to a CSV file for further analysis by selecting Export results.
Verify Audit Logging: If no results appear, audit logging may be disabled. To enable it, go to the Audit section and click Start recording user and admin activity. Allow up to 60 minutes for activation.

Additional Information

Audit logs retain data for 90 days for standard licenses or up to 1 year for premium licenses (e.g., Microsoft 365 E5).
Events may take up to 24 hours to appear in the audit log, especially for SharePoint activities.
If a user was blocked from downloading due to permissions or conditional access policies, you may see "Access denied" events instead of "Downloaded file."

Troubleshooting Tips

No results found: Ensure audit logging is enabled and the date range includes the period of activity. Check if the user’s email or name is entered correctly.
Too many results: Narrow the search by specifying a user, file, or site, or select specific activities like "Downloaded file."
Access denied errors: Verify your admin permissions in the Microsoft Purview portal or contact a Global Administrator.
Need detailed reports: Consider third-party tools for user-friendly activity tracking.

Was this helpful?

If you've followed this guide, we'd love to hear about your experience. Please leave a comment below to share whether this guide helped you achieve your goal. If you found an alternative approach that worked, we encourage you to share that as well. Your feedback helps us improve our documentation and assists others in the community.

Need Further Assistance?

If you need additional support or would like personalized guidance, we're here to help. Check out our dedicated support plans at IT Solver Support Plans for expert assistance tailored to your needs.

Related to