Forum Discussion

almun13's avatar
almun13
Copper Contributor
Feb 18, 2025
Solved

Microsoft Purview missing logs

I am trying to retrieve audit logs from Microsoft Purview that reflect SharePoint Online (SPO) list settings, specifically to identify who deleted certain columns. While I am able to obtain logs for ...
SPO List deleted column
  • VasilMichev's avatar
    VasilMichev
    Feb 20, 2025

    Try without scoping the results to a site also, just for the sake of testing. If you are not seeing anything, you'll have to work with support I'm afraid.

almun13's avatar
almun13
Copper Contributor
Feb 19, 2025

Hi Vasil,

Thank you for your previous advice. Unfortunately, I tried your suggestions but still haven't had any success. Could you please provide further guidance or alternative solutions?

 

VasilMichev's avatar
VasilMichev
MVP
Feb 20, 2025

Try without scoping the results to a site also, just for the sake of testing. If you are not seeing anything, you'll have to work with support I'm afraid.

  • almun13's avatar
    almun13
    Copper Contributor
    Feb 21, 2025

    Thanks Vasil,

    I ran a search with the RecordType "SharePointListOperation" without scoping the results to a specific site, and it returned the result "Updated List."

    When I ran a search with "listcolumndeleted" without scoping the results to a site, it returned the "Deleted list column" for different sites.

    Is this the correct way to obtain the audit logs, or could there be an issue with the Purview configuration?

Resources