Forum Discussion
Purview and auditing file modifications
I have full M365 E5 license and use Purview auditing a lot for investigations. I noticed is reports file modified which is create but some of my files would get modified constantly. I'm curious if ...
Below Can and Can't Do for Microsoft Purview:
Can:
- File-level operations: Create, modify, delete, access, download
- User actions: Who did what and when
- Audit metadata: File name, location, operation type, timestamp, user ID
Can’t
- Content-level changes: Purview does not log what was added, deleted, or changed inside a document
- Inserted images or media: It won’t tell you if an image was pasted or provide a copy of it
- Delta comparisons: No native diffing between file versions
Consider SharePoint versioning so that you can compare versions manually or via PowerShell