Audit Log in Sharepoint Collection - Can I pull a report prior to date of the settings change?

%3CLINGO-SUB%20id%3D%22lingo-sub-542229%22%20slang%3D%22en-US%22%3EAudit%20Log%20in%20Sharepoint%20Collection%20-%20Can%20I%20pull%20a%20report%20prior%20to%20date%20of%20the%20settings%20change%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-542229%22%20slang%3D%22en-US%22%3E%3CP%3EI%20forgot%20to%20turn%20on%20the%20audit%20log%20setting%20for%20a%20SharePoint%20collection%2C%20and%20now%20need%20to%20run%20a%20report%20for%20last%20week.%20Is%20it%20possible%20to%20pull%20that%20data%20even%20though%20I%20only%20enabled%20the%20audit%20reporting%20today%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-542229%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Eaudit%20log%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Esharepoint%20collection%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-542237%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20in%20Sharepoint%20Collection%20-%20Can%20I%20pull%20a%20report%20prior%20to%20date%20of%20the%20settings%20change%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-542237%22%20slang%3D%22en-US%22%3EHave%20you%20enabled%20audit%20logging%20for%20office%20365%3F%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fsearch-the-audit-log-in-security-and-compliance%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fsearch-the-audit-log-in-security-and-compliance%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EIf%20you%20haven%E2%80%99t%20done%20this%20there%E2%80%99s%20no%20collected%20data%20to%20be%20fetched!%3CBR%20%2F%3E%3CBR%20%2F%3EAdam%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-542239%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20in%20Sharepoint%20Collection%20-%20Can%20I%20pull%20a%20report%20prior%20to%20date%20of%20the%20settings%20change%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-542239%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F72542%22%20target%3D%22_blank%22%3E%40adam%20deltinger%3C%2FA%3E%26nbsp%3B%20Yes%2C%20but%20I%20only%20did%20it%20today.%20The%20data%20I%20need%20is%20from%20last%20week.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-542262%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20in%20Sharepoint%20Collection%20-%20Can%20I%20pull%20a%20report%20prior%20to%20date%20of%20the%20settings%20change%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-542262%22%20slang%3D%22en-US%22%3EAFAIK%20no%20sorry!%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-542606%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20in%20Sharepoint%20Collection%20-%20Can%20I%20pull%20a%20report%20prior%20to%20date%20of%20the%20settings%20change%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-542606%22%20slang%3D%22en-US%22%3EIf%20you%20have%20enabled%20Today%20SPO%20Audit%20Logs%20and%20also%20the%20Office%20365%20Logs%2C%20you%20cannot%20get%20any%20information%20before%20Today%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-544901%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20in%20Sharepoint%20Collection%20-%20Can%20I%20pull%20a%20report%20prior%20to%20date%20of%20the%20settings%20change%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-544901%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F281812%22%20target%3D%22_blank%22%3E%40memacdou%3C%2FA%3E%26nbsp%3BIf%20you%20turned%20on%20Office%20365%20Auditing%20already%2C%20then%20most%20of%20the%20SharePoint%20online%20events%20are%20collected%20even%20if%20you%20didn't%20enable%20Site%20Collection%20Auditing.%20Site%20Collection%20Auditing%20needs%20to%20be%20enabled%20only%20when%20you%20need%20detailed%20activities%20such%20as%20page%20view%2C%20check%20in%2C%20check%20out%2C%20etc.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20you%20haven't%20enabled%20the%20Office%20365%20auditing%20already%20then%20there%20is%20no%20way%20to%20solve%20your%20requirement.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

I forgot to turn on the audit log setting for a SharePoint collection, and now need to run a report for last week. Is it possible to pull that data even though I only enabled the audit reporting today? 

 

 

5 Replies
Highlighted
Have you enabled audit logging for office 365?

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-c...

If you haven’t done this there’s no collected data to be fetched!

Adam
Highlighted

@adam deltinger  Yes, but I only did it today. The data I need is from last week.

Highlighted
Highlighted
If you have enabled Today SPO Audit Logs and also the Office 365 Logs, you cannot get any information before Today
Highlighted

@memacdou If you turned on Office 365 Auditing already, then most of the SharePoint online events are collected even if you didn't enable Site Collection Auditing. Site Collection Auditing needs to be enabled only when you need detailed activities such as page view, check in, check out, etc.

 

If you haven't enabled the Office 365 auditing already then there is no way to solve your requirement.