Carrying out an Search (Audit) on whose accessed a SharePoint document (Excel, Word, etc,)

Hi Chris_Clark1968,

you can use Microsoft Purview (https://compliance.microsoft.com/) to audit who has accessed a SharePoint document on Microsoft 365.

Here are the steps to do so:

- Use the Audit search tool in the Microsoft Purview compliance portal.
- You can search for specific activities in Audit, for activities performed by specific users, and activities that occurred within a date range.

You can use the audit log reports provided with SharePoint to view the data in the audit logs for a site collection. You can sort, filter, and analyze this data to determine who has done what with sites, lists, libraries, content types, list items, and library files in the site collection.

The default retention period for Audit (Standard) logs in Microsoft 365 has changed from 90 days to 180 days.

Audit (Standard) logs generated before October 17, 2023 are retained for 90 days. Audit (Standard) logs generated on or after October 17, 2023 follow the new default retention of 180 days.

However, if you want to retain an audit log for longer than 180 days (and up to 1 year), the user who generates the audit log (by performing an audited activity) must be assigned an Office 365 E5 or Microsoft 365 E5 license or have a Microsoft 365 E5 Compliance or E5 eDiscovery and Audit add-on license.

Here are some useful links:
Manage audit log retention policies | Microsoft Learn
Set up Audit (Standard) in Microsoft 365 | Microsoft Learn
Auditing solutions in Microsoft Purview | Microsoft Learn