Audit trail for OneNote Notebooks

%3CLINGO-SUB%20id%3D%22lingo-sub-225431%22%20slang%3D%22en-US%22%3EAudit%20trail%20for%20OneNote%20Notebooks%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-225431%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%20there!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20a%20way%20to%20search%20for%20user%20activities%20in%20OneNote%20notebooks%3F%20For%20example%2C%20if%20someone%20created%20a%20new%20notebook%2C%20deleted%20a%20page%20or%20added%20a%20section%20to%20a%20notebook%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20cannot%20find%20a%20category%20in%20Audit%20log%20to%20search%20for%20OneNote%20activities.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20in%20advance.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-227721%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20trail%20for%20OneNote%20Notebooks%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-227721%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%2C%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F11171%22%20target%3D%22_blank%22%3E%40Max%20Fritz%3C%2FA%3E!%20I%20shared%20the%20info%20with%20our%20users.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBTW%2C%20I%20found%20a%20way%20to%20create%20an%20audit%20trail%20of%26nbsp%3Bevents%26nbsp%3Bfor%20OneNote%20using%20Splunk.%20Splunk%20has%20an%20O365%20Management%20Add-on%20that%20gets%20Office%20365%20logs%20and%20admins%20can%20create%20queries%20from%20those%20files.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-227343%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20trail%20for%20OneNote%20Notebooks%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-227343%22%20slang%3D%22en-US%22%3EUnfortunately%20those%20activities%20are%20not%20in%20the%20Audit%20log%20at%20this%20time.%20You%20can%20however%20open%20the%20individual%20notebook%20and%20review%20history%20from%20there%3A%20%3CA%20href%3D%22https%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2Fsee-a-list-of-recent-changes-in-a-notebook-in-onenote-for-windows-55dc5183-9112-4c7e-a9cf-44cd66c19c77%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2Fsee-a-list-of-recent-changes-in-a-notebook-in-onenote-for-windows-55dc5183-9112-4c7e-a9cf-44cd66c19c77%3C%2FA%3E%3C%2FLINGO-BODY%3E
Contributor

 

Hi there!

 

Is there a way to search for user activities in OneNote notebooks? For example, if someone created a new notebook, deleted a page or added a section to a notebook?

 

I cannot find a category in Audit log to search for OneNote activities.

 

Thank you in advance.

2 Replies
Unfortunately those activities are not in the Audit log at this time. You can however open the individual notebook and review history from there: https://support.office.com/en-us/article/see-a-list-of-recent-changes-in-a-notebook-in-onenote-for-w...

Thanks, @Max Fritz! I shared the info with our users.

 

BTW, I found a way to create an audit trail of events for OneNote using Splunk. Splunk has an O365 Management Add-on that gets Office 365 logs and admins can create queries from those files.