Forum Discussion

Chris_Clark1968's avatar
Chris_Clark1968
Brass Contributor
Nov 21, 2023

Carrying out an Search (Audit) on whose accessed a SharePoint document (Excel, Word, etc,)

Hi,

I've been asked to carry out an Audit on who as accessed a number of files within a Document that is held on SharePoint.

I used Microsoft 365 security to perform the action

Search criteria 

From the search results the details seemed to represent the users document settings and not SharePoint

New Search screen



What would be the criteria to use to find this??

Can I go back more that 180 days??

 

  • LeonPavesic's avatar
    LeonPavesic
    Silver Contributor

    Hi Chris_Clark1968,

    you can use Microsoft Purview (https://compliance.microsoft.com/) to audit who has accessed a SharePoint document on Microsoft 365.

    Here are the steps to do so:

    - Use the Audit search tool in the Microsoft Purview compliance portal.
    - You can search for specific activities in Audit, for activities performed by specific users, and activities that occurred within a date range.

    You can use the audit log reports provided with SharePoint to view the data in the audit logs for a site collection. You can sort, filter, and analyze this data to determine who has done what with sites, lists, libraries, content types, list items, and library files in the site collection.

     

    The default retention period for Audit (Standard) logs in Microsoft 365 has changed from 90 days to 180 days.

    Audit (Standard) logs generated before October 17, 2023 are retained for 90 days. Audit (Standard) logs generated on or after October 17, 2023 follow the new default retention of 180 days.

    However, if you want to retain an audit log for longer than 180 days (and up to 1 year), the user who generates the audit log (by performing an audited activity) must be assigned an Office 365 E5 or Microsoft 365 E5 license or have a Microsoft 365 E5 Compliance or E5 eDiscovery and Audit add-on license.


    Here are some useful links:
    Manage audit log retention policies | Microsoft Learn
    Set up Audit (Standard) in Microsoft 365 | Microsoft Learn
    Auditing solutions in Microsoft Purview | Microsoft Learn


    Please click Mark as Best Response & Like if my post helped you to solve your issue.
    This will help others to find the correct solution easily. It also closes the item.


    If the post was useful in other ways, please consider giving it Like.


    Kindest regards,


    Leon Pavesic
    (LinkedIn)

    • Chris_Clark1968's avatar
      Chris_Clark1968
      Brass Contributor

      Hi LeonPavesic

      Thank you for your reply.

      I haven't be assigned an E5 license.  This is being requested

      I've entered the criteria search information 

       

      The field with the red crosses, I've entered the folder name, Sub folder name.  Inserted the folder, sub folder and for a single excel document in there but no results are returned.

      This is the folder an audit is being carried out on

      There are 17 sub folders and each one will have multiple excel documents.  I need to see who as viewed / accessed them


      There 

      Can an audit be carried out for an entire folder??


       


      • Drobin84's avatar
        Drobin84
        Copper Contributor

        Chris_Clark1968 

         

        did you ever get a reply or resolution? we are in the same boat. Unless we do a blank search that contains ALL downloaded activities, we cannot get results for specific URL.

Resources