How to Monitor SharePoint Audit Logs for Suspicious Activity

This guide shows you how to monitor SharePoint audit logs to detect suspicious activity like unauthorized access, mass downloads, or permission changes. You’ll learn how to search the unified audit log in the Microsoft Purview portal, set up alerts, and respond to findings. You’ll need SharePoint administrator or global admin permissions to access the audit log.

What You’ll Need

• Global admin or SharePoint admin role in Microsoft 365
• Audit log search enabled in the Microsoft Purview portal (it’s on by default for most tenants)
• Access to the Microsoft Purview compliance portal (compliance.microsoft.com)

Step-by-Step

1. Go to the audit log search. Open your browser and navigate to compliance.microsoft.com. Sign in with an account that has the necessary permissions. In the left navigation, select Audit under the Solutions section. If you don’t see it, click Show all first.
2. Set the date range. On the Audit page, choose a date range using the Start date and End date fields. For a first check, use the last 30 days. Note that the audit log retains data for 90 days by default (or longer if you’ve enabled retention policies).
3. Select activities to focus on. In the Activities drop-down, you can pick specific actions. For suspicious activity, focus on these categories:
   • File and page activities: Accessed file, Downloaded file, Deleted file, Moved file
   • Permission activities: Added user to SharePoint group, Removed user from SharePoint group, Changed site permission
   • Sharing activities: Shared file externally, Created sharing link, Revoked sharing link

   You can select multiple activities by checking the boxes. If you want to see everything, leave the dropdown at its default (which shows all activities).

4. Run the search. Click Search. The results will appear in a table below. Each entry shows the date, IP address, user, activity, and item. Review the results for anything unusual.
5. Filter results for suspicious patterns. Use the Filter button (funnel icon) to narrow down. For example, filter by User to see a specific person’s actions, or by IP address to spot logins from unusual locations. Look for:
   • Mass downloads (many “Downloaded file” events in a short time)
   • External sharing to personal email domains (like gmail.com, yahoo.com)
   • Permission changes by users who normally don’t do that
   • Failed login attempts followed by successful access
6. View details of a specific event. Click on any row to open the details pane. This shows the full record, including the exact time, the user’s client IP, and the item’s URL. For file-related events, you can also see the file name and the site URL.
7. Export the results. If you need to keep a record or analyze further, click Export and choose to download all results or just the ones you’ve filtered. The export is a CSV file that you can open in Excel.
8. Set up alerts for recurring checks. To automate monitoring, go to the Alert policies in the Purview portal (under Policies > Alert policy). Create a new alert policy with conditions like:
   • Activity: “Downloaded file”
   • Activity: “Shared file externally”
   • Activity: “Changed site permission”

   Set the threshold (e.g., alert when 10 downloads happen in 5 minutes). You’ll get email notifications when the threshold is met.

9. Review alerts regularly. Even with alerts, check the audit log periodically (e.g., weekly) to catch patterns that don’t trigger alerts. Use the steps above to run a manual search each week.

Common Mistakes

• Not enabling audit log search. If you’ve never used the audit log, it might be disabled. Check in the Purview portal under Audit > Audit settings and enable it if needed.
• Using too narrow a date range. Suspicious activity might have happened weeks ago. Always start with a broader range (30-90 days) and then narrow down.
• Ignoring the IP address. The IP address is crucial. A user logging in from a different country or a known VPN should raise a red flag. Don’t just look at the user name.
• Not filtering for external sharing. External sharing is a top risk. Make sure you specifically look for “Shared file externally” and “Created sharing link” events.
• Forgetting to review alerts. Setting up alerts is useless if you don’t act on them. Check your email and the Purview portal’s alerts page regularly.

Tips

• Use the audit log search page’s built-in filters. The filter options let you quickly sort by user, IP, date, or activity without exporting.
• Create a saved search. If you run the same search every week, save the search parameters so you don’t have to re-enter them.
• Understand the “Item” column. For file events, the item column shows the full URL path. For site events, it shows the site URL. This helps you pinpoint the affected resource.
• Combine with other logs. For deeper investigation, cross-reference the audit log with the Azure AD sign-in logs (in the Azure portal or Entra admin center) to see the user’s login history and device details.
• Know the default retention. The audit log is kept for 90 days. If you need longer, enable audit log retention policies in the Purview portal (up to 10 years for some licenses).

Troubleshooting

• No results appear. First, check your date range – make sure the start date is before the end date. Then, check if you have the right permissions. If you’re not a global admin or SharePoint admin, you might not see all entries. Also, verify that audit log search is enabled in your tenant.
• Search takes a long time. For large tenants, searching a 90-day range can be slow. Try narrowing the date range or using specific activities to speed it up.
• Export fails. The export can time out if you have too many results. Try filtering first, or export in smaller date chunks (e.g., one week at a time).
• Alerts not triggering. Check that the alert policy is enabled. Also, verify the threshold – if you set it too high, it won’t fire. Test by performing an action that should trigger it and see if you get a notification.
• You see “Audit log search is not enabled” error. Go to Audit in the Purview portal, click Audit settings, and turn on the toggle. It usually takes a few hours to become fully active.

Frequently Asked Questions

How long are SharePoint audit logs kept?

By default, audit logs are retained for 90 days. You can extend this up to 10 years with an appropriate license and retention policy.

Can I monitor a specific site collection?

Yes, you can filter by the site URL in the search results. In the audit log search, use the File or Site filter, or simply look at the item URL in the results.

What activities should I consider most suspicious?

Mass downloads, external sharing to personal domains, permission changes by non-admins, and logins from unusual IP addresses are the top red flags.

Do I need a special license to use the audit log?

Basic audit log search is available for most Microsoft 365 subscriptions. Advanced features like long-term retention and high-value alerts require an E5 or additional compliance license.

Can I get alerts in real time?

Yes, alert policies can send email notifications within minutes of the activity occurring. However, there is a slight delay (usually 5-10 minutes) between the event and the alert.

How do I check who shared a file externally?

Search for the activity “Shared file externally” and filter by the file name or user. The details pane will show the sharing link and the target user.

Related

• Async Work Norms & When to Meet
• Insta Account Hack: What It Really Takes
• Language Detection Caching & Rate Limits Guide