Forum Discussion
Where did site collection audit report go?
Hello all, A user has requested an audit report for their site collection but it appears the option is no longer available (see attached). SharePoint Online, Modern Site. The audit report setti...
Hi Frederick Wilson
See article here
https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-A9920C97-38C0-44F2-8BCB-4CF1E2AE22D2
Office 365 Unified Audit Logging now supports SharePoint Online and OneDrive for Business. Unified auditing provides access to event logs on view, create, edit, upload, download and delete, and sharing actions like invitation and access requests, and also synchronization activity. For more information about what Unified Audit in Office 365 provides for SharePoint Online
Assuming you have audit logging enabled on your tenant, you should be able to pick this up in the Unified Audit Log within the Security and Compliance Centre. See here
https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance#audited-activities
Le me know how you get on!
Best, Chris
See article here
https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-A9920C97-38C0-44F2-8BCB-4CF1E2AE22D2
Office 365 Unified Audit Logging now supports SharePoint Online and OneDrive for Business. Unified auditing provides access to event logs on view, create, edit, upload, download and delete, and sharing actions like invitation and access requests, and also synchronization activity. For more information about what Unified Audit in Office 365 provides for SharePoint Online
Assuming you have audit logging enabled on your tenant, you should be able to pick this up in the Unified Audit Log within the Security and Compliance Centre. See here
https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance#audited-activities
Le me know how you get on!
Best, Chris
Thanks for the input but the results in the unified audit logging, does not match the site collection audit log.
Example, we are trying to determine who gave a user access to a site collection. If I use Sharegate, the log clearly shows who gave that user access. However, the Unified logging feature doesn't show anything at all for this specific site collection.
I noticed the disparity in logs when MS accidently enabled Everyone except external users as a visitor to the base tenant site. The unified log did not show the change but the site collection log showed that it was a system account change. When I brought this up to MS, their answer was that they could not do anything because it is not in the unified log.
- Hi Frederick Wilson
In that case I would recommend to ask both Microsoft and ShareGate (since they would probably be aware of this) if there is any dedicated SharePoint site collection audit reports at this current time similar to SharePoint Server. I personally haven't heard of any - and I wouldn't be surprised if it's unlikely because
1.) It's directing to the Unified Audit Log in the documentation
2.) It's an opportunity for partners such as ShareGate to build and wrap tools for enhanced auditing
I was with a vendor just last week who had built an app around managing permissions because there is no clean way to view and manage permissions across multiple site collections
It would be good to get a confirmation on this - it's would really help community understanding
Best, Chris- This is a know issue with modern sites: part of the audit features are hidden and that's the reason why you are missing a link here...there is trick to go there: grab the missing url from a classic SPO site and them you have it. By the way, Audit Log in the Compliance Center provides much more information compared with what you have with the SPO Audit Log. In regards of how Sharegate does it, just remember is a third party tool that uses SPO API to get all the audit information, so no rocket science here...indeed you could potentially write your own PS scripts to get audit log information and generate custom reports
- Thanks jcgonzalezmartin that's great to know for the future!
In that case Frederick Wilson probably no need to contact Microsoft and ShareGate now that Juan Carlos has provided the answer.
Best, Chris
