Forum Discussion
Purview and auditing file modifications
I have full M365 E5 license and use Purview auditing a lot for investigations.
I noticed is reports file modified which is create but some of my files would get modified constantly. I'm curious if it can log and provide a report on what exactly was modified. For example:
If text was added or deleted, can it tell me what was added or deleted i.e. the actual text and the action (Add\Delete)
If an image was pasted into a word document, can it tell me that? If possible, down to a copy of the image that was inserted?
If it can't do this level of detail anyone have suggestions of a product that can?
1 Reply
Below Can and Can't Do for Microsoft Purview:
Can:
- File-level operations: Create, modify, delete, access, download
- User actions: Who did what and when
- Audit metadata: File name, location, operation type, timestamp, user IDCan’t
- Content-level changes: Purview does not log what was added, deleted, or changed inside a document
- Inserted images or media: It won’t tell you if an image was pasted or provide a copy of it
- Delta comparisons: No native diffing between file versionsConsider SharePoint versioning so that you can compare versions manually or via PowerShell
