Home
Microsoft

SharePoint Online Site Collection Admin Audit Log Changes

@williambaer

 

Beginning July 24th, 2017, we're making some important changes to SharePoint Online Site Collection Admin Audit Logging.

 

Site Collection Admin Audit Logging enables administrators to keep a reliable log of what is happening with important content on a site collection. Administrators are able to retrieve the entire history of actions taken by a particular user and can also retrieve the entire history of actions taken during a particular date range.  For example, site administrators can use auditing to track how documents and items are used throughout a site collection.

 

Beginning July 24th, 2017 for First Release enabled Office 365 Tenants, we will be making changes to the SharePoint Online Site Collection Administration Audit Log feature by enforcing a 90-day retention period. Customers who used this feature previously will be automatically updated to the new retention policy and settings. New customers who subscribed to Office 365 after this change will be forced to use the 90-day retention period. Customers can either accept the default of 90 days or input a smaller number of days.

 

Important: This change does not impact the Unified Auditing experience from the Office 365 Security & Compliance Center.

 

Frequently Asked Questions

 

What does this mean for existing Office 365 Tenants?

The SharePoint Online Site Collection Admin Audit Log feature is primarily used by a small percentage of our Office 365 customers for their own site auditing. Existing Office 365 customers who currently use the SharePoint Online fall in to one of four categories of audit log usage.

 

Audit Data?

Trimming Set?

Experience after change

Yes

Yes

Enforce 90 days to retain audit log data if the value is set to greater than 90 days. Leave the established document library path for storing audit data longer than 90 days.

Yes

No

Set retention to 90 days and set the document library path to the default document library.

No

Yes

Enforce 90 days to retain audit log data if the value is set to greater than 90 days. Leave the established document library path for storing audit data longer than 90 days.

No

No

Set retention to 90 days and set the document library path to the default document library.

 

How can I view data that's beyond the 90-day retention period?

Once the 90-day retention period is met an Excel file will automatically get created in the document library specified. These files will contain audit data from specific periods of time. The data will not be lost. Instead the data will be found in an Excel file.

 

To learn more about Site Collection auditing refer to the support documentation at https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-C4EE05E1-2EB....

6 Comments

>Once the 90-day retention period is met an Excel file will automatically get created in the document library specified

How do you specify the document library.

Is the document visible only to Site Collection Admins?

 

Your Learn More link points to a help article for SP2007 server. Surely there is more recent and relevant documentation?

Microsoft

@Kevin Crossman The document library can be specified in the "Configure Audit Settings" page that is accessible to the Site Collection Admins. See the updated help document below. https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-A9920C97-38C...

Hey @Bill Baer,

Will the data from the audit log be available through an API endpoint so we could get it into our systems and formats?

Thanks

Microsoft

@Tobias Zimmergren Audit data older than 90 days will be uploaded as excel sheets to the selected document library. You can use the usual REST API to access files/folders in SPO to download the excel files and process the data. There are not special APIs to access this audit data.

Regular Visitor

@Rakesh Patnaik or @Bill Baer I have tried to use this functionality by setting the audit log trimming value to 2 days in my O365 tenant. It is not generating any excel files for that site collection and other test site collection. I have raised this with the O365 support team and got the reply that it is by design and there is no way to get this logs to any document library by setting trimming value. But this post is showing some different story. Please advice on the following queries, it would be really appreciated

 

How to check that, this new functionality is pushed to our tenant?

Is this functionality work, if I specify less than 90 days like 5 days?

Do I need to specify the document library manually in the site collection or it automatically trim the audit logs and keep it in any default library? ( I understood from the top comments that i have to set this up for each site collection)

Occasional Contributor

According to this post those of us with the 90 day setting should see an excel file in the specified document libraries on 10/25. I'll be creating a reminder to check!