0

I am trying to figure out how to view Audit logs for the SharePoint Online site. On our on-prem SharePoint 2013 farm in the configure audit settings for a particular site collection, I have audit option for opening or downloading documents, viewing items in lists or viewing item properties.

Unfortunately, that audit item for the SPO is not available, on the Microsoft documentation, it is not there for the site as well.

Do I need to enable this on the tenant level for this option to be available on the auditing of the site collections? Or something else?

Toni Frankola
  • 724
  • 1
  • 7
  • 14
LukeA
  • 3
  • 1

2 Answers2

0

I can't speak to the on premises version of Sharepoint, but in Office 365 auditing needs to be enabled at the Tenant level.

Log into the Office 365 admin portal, go to Admin centers>Security & Compliance>Search>Audit log search and enable it.

Audit log search is not enabled by default in Office 365 so you have to enable it for your Tenant.

joeqwerty
  • 108,377
  • 6
  • 80
  • 171
0

When it comes to SharePoint Online, the service has evolved a bit from the SharePoint 2013 on-premises, and in your particular case auditing is bit different. Here are your options:

1. Site usage

Available on the new modern SharePoint Communication sites (Click on the Settings cog in the top menu, then Site Usage). This is going to show you visits to a particular site collection, along with some other interesting statistics. This does track views, but only high-level.

enter image description here

2. Site collection audit

Same as in SharePoint 2013, you need to go to Site Settings and then first enable this via Site collection audit settings option. The following events can be tracked: Editing items, Checking out or checking in items, Moving or copying items to another location in the site, Deleting or restoring items, Editing content types and columns, Searching site content, Editing users and permissions. SharePoint will periodically dump data into an Excel file. This approach does not give you views.

3. Audit log search

Your third option is to use the Audit Log Search from the Office 365 Security & Compliance center. This is the most comprehensive source of the information you can get. This audit log also needs to be enabled. The audit logs are retained for 90 days, but E5 licenses are currently being expanded to be retained up to 1 year. This option will give you a plethora of audit events, including views of documents and SharePoint stuff. Note that, it will also give you a lot more information about other workloads in Office 365.

4. PowerShell

The fourth option is the subset of the third option as it uses the same data source. You can use the following PS command from the Exchange Online PowerShell module retrieves all the audit log events in the given period:

Search-UnifiedAuditLog -StartDate 04/24/2019 -EndDate 04/25/2019

To learn how to connect you can check this blog on Office 365 auditing.

5. Office 365 Management APIs

This option also relies on the same mechanisms as options 3 and 4, but it does give the ultimate flexibility on how you retain and manage your data. The idea with Management APIs is for you to develop your end-point that is going to store data on your end for future retention. Check this blog fore mroe info.

Toni Frankola
  • 724
  • 1
  • 7
  • 14