ITS

Information Technology Services
Information Technology Services

Auditing in SharePoint Online and OneDrive for Business

Site collection administrators (site owners) can enable the auditing and reporting feature in SharePoint Online and OneDrive for Business to track the user actions on site's content types, lists, libraries, list items, and library files. Site pages (.aspx) cannot be audited as they are not considered documents.

Note: The information provided on this page covers auditing and reporting features available to SharePoint site collection administrators (site owners). Advanced auditing and reporting capabilities, such as Office 365 Unified Auditing Logging, are available to Office 365 Administrators (ITS) for security and compliance purposes. For more information about what Unified Auditing in Office 365 provides for SharePoint Online, see Audited activities. Contact the IT Support Centre if advanced auditing reports are required.

Auditing and reporting

Events available for reporting

Events that can be audited for documents and items:

  • Edited items

  • Checked out and checked in items

  • Items that have been moved and copied to other location in the site collection

  • Deleted and restored item

Events that can be audited for lists, libraries, and sites:

  • Changes to content types and columns

  • Site search queries

  • Changes to user permissions

Note: Auditing of opened and downloaded documents, viewed items in lists, or viewed item properties is not available in SharePoint Online.

Activate reporting

  1. On the Site Settings page, under Site Collection Administration, select Site collection features.

  2. On the Site Collection Features page, locate Reporting from the list of features and then select the Activate button.

  3. Verify that Reporting is activated (there should now be two buttons associated with the Reporting feature: Deactivate and Active).

Viewing audit log reports

Available audit log reports

Content activity reports

Content viewing

Not available. This report will be blank as opened and downloaded documents, viewed items in lists, or viewed item properties events are not captured during auditing.

Content modifications

This report shows all events that changed content on the site, such as modifying, deleting, and checking documents in and out.

Deletion

This reports all events that caused content on the site to be deleted or restored from the Recycle Bin.

Content type and list modifications

This report shows all events that modified content types and lists in the site (e.g. additions, edits, and deletions).

Information management policy reports

Policy modifications

This report shows all events related to the creation and use of information management policies on content in the site.

Expiration and Disposition

This report shows all events related to the expiration and disposition of content in the site.

Security and site settings reports

Auditing settings

This report shows all events that changed auditing settings.

Security settings

This report shows all events that change the security settings on the site, such as user/group events, and role and rights events.

Run a custom report

With a custom report, specific filters can be used to customize the report, such as limiting the report to a specific set of events, to items in a particular list, to a particular date range, or to events performed by particular users.

View audit log reports

  1. Go to the SharePoint site or your OneDrive for Business document library.

  2. Select the Settings icon. In the Settings pane, select Site Settings. If you do not see Site settings, click Site information and then click View all site settings. Some pages might require you to select Site contents, and then Site settings. In OneDrive for Business, select Return to classic OneDrive from the navigation pane before selecting the Settings icon.

  3. On the Site Settings page, under Site Collection Administration, select Audit log reports.

  4. On the View Auditing Reports page, select the report to view.

  5. On the Customize Report page, type a URL or Browse to the library where you want to save the report (.xlsx format) and then click OK.

  6. On the Operation Completed Successfully page, select Click here to view the report. Note: If you receive an error message, such as "Sorry, something went wrong", it may be because audit logs weren't enabled or there was no data to show. You can attempt to run another type of report or may want to verify your report settings.

Learn more

Last Updated: October 8, 2019