Forum Discussion
SharePoint Online Forensics
Hello all, we have a situation where someone put a file out in a shared space and someone accessed it that was not supposed to. How are we as O365 Admins supposed to tell when that document was acc...
As a side note I do knwo about and understand "Audit Logs" in SharePoint online - however I am seeing that they were not turned on. So is there a way to retroactively see when someone accessed a document?
As you say, best option you have is through audit logs and If those were not enabled is going to get difficult to get what you are looking for...only opportunity I se is to dig into the SPO Change log, but you will need a developer to help you on programatically access the SPO Change log