SharePoint Audit Logs in Microsoft Purview: A Practical Admin Guide

SharePoint stores some of the most important business data in Microsoft 365: files, contracts, project documents, customer records, internal pages, and collaboration history.

That also means every permission change, external sharing link, file download, deletion, and site-level update matters.

A SharePoint audit log helps admins answer the basic but critical question:

Who did what, when, and where?

Today, SharePoint audit events are not handled through the old site-collection audit reports most admins may remember. In modern Microsoft 365, SharePoint audit activity is searched through Microsoft Purview Audit, as part of the Unified Audit Log.

This guide explains what SharePoint audit logs capture, where to search them, which record types matter, and which reports every SharePoint admin should keep ready.

---

What changed with SharePoint audit logs?

In older SharePoint environments, admins often looked for audit settings inside individual site collections.

That is no longer the main model for SharePoint Online.

In Microsoft 365, SharePoint audit events flow into the Unified Audit Log. The same audit system also supports activities from Exchange, Teams, OneDrive, Entra ID, Power BI, Power Automate, and other Microsoft 365 services.

For SharePoint Online, Microsoft lists record types such as:

Record type	What it helps track
SharePointFileOperation	File access, downloads, uploads, edits, deletes, moves, copies, previews
SharePointSharingOperation	Sharing invitations, anonymous links, company links, external sharing events
SharePoint	Site administration, permissions, settings, and governance events
SharePointListOperation	List and list-item related activities
SharePointCommentOperation	Comment-related activities

Microsoft documents these SharePoint Online record types as part of the services supported by Microsoft Purview auditing.

The important takeaway is simple:

If you want to audit SharePoint Online today, start with Microsoft Purview Audit — not old site-level audit pages.

---

Why SharePoint auditing matters

SharePoint rarely fails because one admin forgot to check a log.

It fails because risky activity stays invisible for too long.

A few common examples:

Someone creates an anonymous sharing link to a sensitive folder.

A project site keeps external access long after the project ends.

A temporary Full Control permission becomes permanent.

A user downloads hundreds of files before leaving the company.

A site owner breaks permission inheritance and no one reviews it again.

During a migration, old sharing links and permission changes are moved forward without being revalidated.

Without audit logs, these issues are difficult to prove. With audit logs, admins can build a timeline of activity and understand what changed.

That matters for security investigations, compliance reviews, insider-risk checks, and tenant-to-tenant migration planning.

---

What SharePoint audit logs can capture

SharePoint audit logs are broader than just “file opened” or “file deleted.”

In Microsoft Purview Audit, SharePoint activity can include several categories.

File and page activity

These events help you understand how users interact with files and pages.

Examples include:

FileAccessed, FileModified, FileDownloaded, FileUploaded, FileDeleted, FileRecycled, FileRestored, FileCopied, FileMoved, FileRenamed, FilePreviewed, and PageViewed.

This is useful when you need to investigate file access, bulk downloads, deleted content, or unusual activity on sensitive sites.

Sharing and access activity

Sharing events are often the most important part of SharePoint auditing.

Examples include:

SharingInvitationCreated, AnonymousLinkCreated, AnonymousLinkUsed, CompanyLinkCreated, SharingSet, AccessRequestCreated, and AccessRequestApproved.

These events help answer questions like:

Who shared this file externally?

Was an anonymous link created?

Did a guest receive access?

Was a company-wide link used?

For organizations preparing for a Microsoft 365 migration, this is one of the most important audit areas to review before cutover.

Permission and admin activity

Permission changes are another high-risk area.

SharePoint audit logs can help track site admin changes, permission level updates, sharing policy changes, and role assignments.

This is especially useful when investigating broken inheritance, unexpected Full Control access, or permission changes on sensitive sites.

List, library, and governance activity

SharePoint audit logs may also include activities related to lists, libraries, labels, retention, and DLP-related events.

This helps security and compliance teams understand how content is being managed, protected, or changed across the tenant.

---

How to search SharePoint audit logs in Microsoft Purview

Most admins can start with the Microsoft Purview portal.

Go to:

Microsoft Purview portal → Audit → Search

From there, configure the search using these filters:

Field	What to use
Date range	Select the investigation period
Record types	Choose SharePoint-related record types
Activities	Select specific activities or leave blank for a broader search
File, folder, or site	Add the site URL or file/folder path when you need a narrow search
Users	Add specific users if the investigation is user-focused
Search name	Use a clear name like Finance Site External Sharing Review

Microsoft notes that audit search uses UTC time, and the maximum date range for a single search in the Purview portal is 180 days. Large searches can also take significant time depending on tenant size, date range, and activity volume.

A good first search for SharePoint admins is:

Record types:
SharePoint, SharePointFileOperation, SharePointSharingOperation

Date range:
Last 7 or 30 days

Scope:
One sensitive site or department site

This gives you a clean starting point without pulling too much noise from the entire tenant.

---

PowerShell option for recurring audit searches

For one-time investigations, the Purview portal is usually enough.

For recurring exports, PowerShell is more practical.

Microsoft confirms that the audit log can be searched using the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell.

Example:

$StartDate = (Get-Date).AddDays(-7)
$EndDate = Get-Date

Search-UnifiedAuditLog `
  -StartDate $StartDate `
  -EndDate $EndDate `
  -RecordType SharePointSharingOperation `
  -ObjectIds "https://contoso.sharepoint.com/sites/Finance/*" `
  -ResultSize 5000 `
  -SessionId "finance-sharing-review" `
  -SessionCommand ReturnLargeSet |
Export-Csv "SharePoint-Sharing-Audit.csv" -NoTypeInformation

Use this pattern when you want to review external sharing, permission changes, deleted files, or bulk download behavior on a regular schedule.

For high-volume audit extraction or security monitoring solutions, Microsoft recommends using the Microsoft 365 Management Activity API instead of relying only on PowerShell scripts.

---

Six SharePoint audit reports every admin should maintain

A raw CSV export is not enough.

A useful audit process turns raw events into reports that answer real questions.

Report	Question it answers	Useful activities
External sharing report	Who shared content outside the tenant?	SharingInvitationCreated, AnonymousLinkCreated, AnonymousLinkUsed, SharingSet
Permission changes report	Who changed access or site admin roles?	PermissionLevelAdded, RoleAssignmentAdded, SiteCollectionAdminAdded, SharingPolicyChanged
Bulk download report	Did one user download an unusual number of files?	FileDownloaded grouped by user
Deleted content report	What was deleted, recycled, or permanently removed?	FileDeleted, FileRecycled, FolderDeleted, FileVersionsAllDeleted
Site activity report	Which sites are active or inactive?	FileAccessed, PageViewed grouped by site
Migration baseline report	What permissions and sharing existed before cutover?	Sharing + permission activities before migration

For most organizations, the first two reports are the most important:

External sharing report

This shows where sensitive data may already be exposed outside the organization.

SharePoint permission changes report

This helps identify risky permission changes before they become long-term governance problems.

---

Audit log retention: what admins should know

Audit retention depends on licensing.

Microsoft states that Audit Standard retains audit records for 180 days for non-E5 users. For users assigned Office 365 E5, Microsoft 365 E5, or eligible Purview audit add-on licensing, Microsoft retains Microsoft Entra ID, Exchange, and SharePoint audit activity for one year by default.

Microsoft Purview Audit Premium can also support longer retention through audit log retention policies. Retention can go up to 10 years with the required add-on licensing and policy configuration.

This is important in mixed-license tenants.

Do not assume the whole tenant gets the same audit retention because some users have E5. Audit retention is tied to the license of the user who generated the activity.

For migration planning, this matters even more.

If the source tenant will be decommissioned after migration, export and preserve the audit evidence before it disappears.

---

Limitations to plan around

SharePoint audit logs are powerful, but they are not a complete monitoring system by themselves.

A few limitations matter:

Audit records are not always instant. Microsoft says core service events such as Exchange, SharePoint, OneDrive, and Teams are typically available within 60 to 90 minutes, but Microsoft does not guarantee a fixed time for every event.

A single Purview portal search is limited to a 180-day date range.

Large audit searches can take longer, especially in large tenants.

Export limits vary by audit license level. Microsoft documents export support up to 50,000 rows for Audit Standard and up to 1,000,000 rows for Audit Premium.

Audit logs record evidence, but they do not automatically create every alert or weekly report you may need.

For real-time alerting, insider-risk detection, or automated governance, you may need Microsoft Defender, Purview Insider Risk Management, Sentinel, the Management Activity API, or a third-party reporting process.

---

Why audit logs matter before a Microsoft 365 migration

A tenant-to-tenant migration is not only a data movement project.

It is also a governance checkpoint.

Before migrating SharePoint content, admins should understand:

Which sites are externally shared

Which files have anonymous links

Which users have elevated permissions

Which sites have broken inheritance

Which sensitive sites have recent downloads or deletes

Which old project sites are inactive

Which permissions should be recreated, restricted, or retired

Do not blindly carry every old sharing relationship into the target tenant.

Some access should move. Some should be reviewed. Some should be removed.

The audit log gives you the evidence to make that decision.

---

Practical weekly audit routine

A simple weekly SharePoint audit routine can be enough to catch many common risks.

Start with these four checks:

Review external sharing activity from the last 7 days.

Check permission changes on sensitive sites.

Look for unusual bulk downloads.

Review deleted content from high-value sites.

Once this becomes routine, expand it into monthly governance reports and migration-readiness checks.

For large tenants, move from manual Purview searches to scheduled exports using PowerShell, Azure Automation, or the Microsoft 365 Management Activity API.

---

Final takeaway

SharePoint audit logs are not just for security incidents.

They are useful for everyday governance, compliance evidence, access reviews, and migration planning.

The most important thing is to start before there is a problem.

Run the sharing report.

Run the permission changes report.

Export the evidence.

Keep a baseline before migration.

Then use that baseline to validate the target tenant after cutover.

In SharePoint governance, the audit log is not the final answer — but it is often the first place you should look.