Forum Discussion
Where did site collection audit report go?
Hello all,
A user has requested an audit report for their site collection but it appears the option is no longer available (see attached).
SharePoint Online, Modern Site.
The audit report setting were configured when the site was created.
I am the site collection administrator
I used Sharegate and there is audit information but I cannot get it right from the site collection.
Thank you.
- It's missing in my environment too. I haven't heard anything about Site Collection level auditing being removed from SharePoint. However, the Office 365 Security and Compliance Admin center provides access to the "Unified Audit Log" (under Search --> Audit Log) which (if enabled) contains audit logs from across Office 365 including SharePoint. I can imagine in the future this should be your go-to place around auditing in everything Office 365
More information on this audit log:
https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance#audited-activities - Hi Frederick Wilson
See article here
https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-A9920C97-38C0-44F2-8BCB-4CF1E2AE22D2
Office 365 Unified Audit Logging now supports SharePoint Online and OneDrive for Business. Unified auditing provides access to event logs on view, create, edit, upload, download and delete, and sharing actions like invitation and access requests, and also synchronization activity. For more information about what Unified Audit in Office 365 provides for SharePoint Online
Assuming you have audit logging enabled on your tenant, you should be able to pick this up in the Unified Audit Log within the Security and Compliance Centre. See here
https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance#audited-activities
Le me know how you get on!
Best, ChrisThanks for the input but the results in the unified audit logging, does not match the site collection audit log.
Example, we are trying to determine who gave a user access to a site collection. If I use Sharegate, the log clearly shows who gave that user access. However, the Unified logging feature doesn't show anything at all for this specific site collection.
I noticed the disparity in logs when MS accidently enabled Everyone except external users as a visitor to the base tenant site. The unified log did not show the change but the site collection log showed that it was a system account change. When I brought this up to MS, their answer was that they could not do anything because it is not in the unified log.
- Hi Frederick Wilson
In that case I would recommend to ask both Microsoft and ShareGate (since they would probably be aware of this) if there is any dedicated SharePoint site collection audit reports at this current time similar to SharePoint Server. I personally haven't heard of any - and I wouldn't be surprised if it's unlikely because
1.) It's directing to the Unified Audit Log in the documentation
2.) It's an opportunity for partners such as ShareGate to build and wrap tools for enhanced auditing
I was with a vendor just last week who had built an app around managing permissions because there is no clean way to view and manage permissions across multiple site collections
It would be good to get a confirmation on this - it's would really help community understanding
Best, Chris
