Forum Discussion
From the "Audit log Search" how i can know who/when our document library got unique permissions
Today i received a complaint from user that he can not access the default document library inside our root site. and when i checked the document library permission, i found that it got unique permissions as follow:-
so at this stage i need to know who/when this action has been done. now only the office 365 admin is defined as a site collection admin on the root site, but many of our admin users use the office 365 username. now from the office 365 admin site >> i accessed the "Audit log Search" >> i enter the url of the document library and chose to show all activities, as follow:-
then i download all the results as .csv (the file size is around 18 MB), but all the activities inside the log file were under these categories:-
- FileAccessed
- FileAccessedExtended
- FileDeleted
- FileDownloaded
- FileModified
- FileModifiedExtended
- FilePreviewed
- FileUploaded
- FolderCreated
- PageViewed
so i am not sure how i can get who modify the library permission and define unique permissions on it? i am sure that this was not the case since 2 weeks as i can see some files and folder have been added/modified 2 weeks ago. also inside the Audit log search should i specify the site url instead of the document library url?
Thanks
1 Reply
Well according to the documentation (https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance#site-permissions-activities), permission changes should be flowing to the unified audit log as well. But that's not the first or the last time we will see issues with the unified log...
Did you try looking directly at the SPO audit log files, accessible via /_layouts/15/Reporting.aspx?Category=Auditing