Forum Discussion
MysticMuffin
Sep 29, 2025Copper Contributor
9M365PurvieweDiscoveryInfra touching files in office activity logs
Hi, We use Office Activity Logs through Log Analytics Workspace to report on specific files. We noticed that in our most recent report, many files were accessed by 'ExportWorker' with 'ClientAppN...
Prathista Ilango
Microsoft
Oct 09, 2025Hello MysticMuffin,
It’s likely that these events are related to export jobs performed during eDiscovery, but since there’s no official documentation confirming this behavior yet, we’ll need to validate internally.
In the meantime, the best way to confirm is to review the Purview audit logs and check whether any export jobs occurred at the same time these entries appeared in the Office Activity logs. This correlation should help verify if the activity is indeed tied to eDiscovery exports.
Regards,
PI
Please mark as solution, if you find the answer helpful. This will assist others in the community who encounter a similar issue, enabling them to quickly find the solution and benefit from the guidance provided.