Skip to main content

Audit Log

The audit log records who did what, and when, across SharePoint and the rest of Microsoft 365. Every file opened, edited, downloaded, shared, or deleted, every permission change, and every site administration action generates an audit record in the Microsoft Purview unified audit log. Auditing is on by default, so the trail already exists; the skill is in searching it. For security investigations, compliance evidence, and answering who deleted that file, the audit log is the authoritative source.
Related
Microsoft 365 Backup, PowerShell, Retention Labels, Retention Policies, Share, Version History

Common Use Cases

  • Deleted file investigations: identify who deleted a document, when it happened, and from which IP address
  • External sharing reviews: see when sharing links and invitations were created across a site and by whom
  • Permission change tracking: trace changes to groups, permission levels, and permission inheritance over time
  • Security incident response: reconstruct what a compromised account viewed, downloaded, or shared
  • Departing employee checks: review what files a user downloaded or synced in their final weeks
  • Compliance evidence: produce activity records for auditors and regulators on demand

Benefits

  • On by default: auditing is enabled automatically for Microsoft 365 organizations, so the history is already being recorded
  • One unified log: SharePoint, OneDrive, Exchange, and Teams activity all land in a single searchable log
  • Rich detail: each record captures the user, the activity, the item, the timestamp, and the IP address
  • Exportable results: search results download to CSV for deeper analysis and evidence packages
  • Scriptable: the Search-UnifiedAuditLog PowerShell cmdlet supports automated and large-scale retrieval
  • Role-gated access: only people holding an audit role can search, keeping activity data away from casual browsing

Details

  • Feature Category: Governance & Compliance

How It Works

  • Unified audit log: SharePoint events flow into the Microsoft Purview unified audit log alongside the other Microsoft 365 workloads
  • Search filters: searches narrow by date range, users, activity types, and keywords such as a file name or site URL
  • Record contents: each result identifies who performed the activity, what was touched, when, and from which IP address
  • Ingestion delay: a record can take from about 30 minutes up to 24 hours to appear after the activity, depending on the service
  • PowerShell access: Search-UnifiedAuditLog retrieves records programmatically for scheduled reports and bulk investigations
  • Audit roles: searching requires an audit-specific role assignment; SharePoint site ownership alone grants no access to the log
  • What gets logged: SharePoint captures file activity (view, edit, upload, download, move, copy, delete, restore), folder changes, sharing and permission events, OneDrive sync, and site administration such as site creation and deletion

Limits and Nuances

  • Retention depends on license: Audit (Standard) keeps records for 180 days, while Audit (Premium) keeps SharePoint, OneDrive, Exchange, and Microsoft Entra records for one year
  • Ten-year option: an add-on license extends retention of a user’s audit records to ten years for long-horizon requirements
  • Newer records only: the 180-day Standard window applies to records generated on or after October 17, 2023; earlier records followed the previous 90-day default
  • Not real time: expect a delay of up to 24 hours before some events become searchable
  • Tenant-level tool: audit search happens centrally in Microsoft Purview, and the older site-level audit log reports have been retired, so the unified log is the single place to search
  • Volume management: busy tenants generate enormous logs, so tight date ranges and specific activity filters keep searches fast and results usable

Common Questions About the Audit Log

What is the audit log in SharePoint?

The audit log is the record of user and administrator activity that Microsoft 365 keeps in the Microsoft Purview unified audit log. For SharePoint, it captures events such as file views, edits, downloads, deletions, sharing, permission changes, and site administration. Each record notes who acted, what they touched, when, and from which IP address, making it the authoritative answer to who did what.

How long are SharePoint audit records kept?

It depends on licensing. Audit (Standard) retains records for 180 days, a default that applies to records generated on or after October 17, 2023. Audit (Premium) keeps SharePoint, OneDrive, Exchange, and Microsoft Entra records for one year, and a separate add-on license extends retention to ten years. Custom audit retention policies can adjust durations within what the license allows.

How do I find out who deleted a file?

Search the audit log with the file name as a keyword and filter to file deletion activities over the relevant date range. The matching records show exactly who deleted the file, when, and from which IP address, including deletions from the Recycle Bin. Pair the finding with the Recycle Bin or the Preservation Hold Library to actually restore the content.

Is auditing enabled by default?

Yes. Auditing is turned on by default for Microsoft 365 organizations, so SharePoint activity is being recorded without any setup. The practical work is on the retrieval side: assigning audit roles to the right people, learning the search filters, and understanding the retention window your licensing provides, since records age out of the log once that window passes.

Can a SharePoint site owner search the audit log?

Not by virtue of owning a site. Audit search lives at the tenant level in Microsoft Purview and requires an audit role assignment, so site owners typically route who-did-what questions through IT or compliance. The site-level audit log reports were retired, which makes the unified audit log the single place this information lives.

What is the difference between the audit log and version history?

Version history shows how a document changed and lets you restore earlier versions; the audit log shows every action around content, including views, downloads, sharing, and deletions that version history never sees. When Greg Zelfond delivers LookBook 365 intranets, he frames version history as the user’s undo button and the audit log as the administrator’s record of truth.