SharePoint Audit Log: How to View, Search & Keep It (2026)

What Is the SharePoint Audit Log?

The SharePoint audit log is the record of who did what to your content in SharePoint Online and OneDrive - files accessed, downloaded, modified, shared, moved, deleted, and permission or sensitivity-label changes. In Microsoft 365 it is not a standalone SharePoint feature but part of the tenant-wide unified audit log in Microsoft Purview, which captures thousands of user and admin activities across SharePoint, OneDrive, Exchange, Teams, and Microsoft Entra ID in one searchable place.

For most SharePoint admins the audit log is the first thing they reach for when a question lands: who deleted that library, who shared a sensitive document externally, what did a departing employee touch in their last week. This guide covers how to find it, how to search it - in the portal and in PowerShell - how long Microsoft keeps it, and the point where the native audit trail stops being enough.

Is SharePoint Auditing On by Default?

Yes. Microsoft Purview Audit (Standard) is enabled by default for every organisation with a qualifying Microsoft 365 subscription, and SharePoint and OneDrive activities are captured automatically. There is no switch to flip to start recording the SharePoint audit trail - the records are already being written. What you do need is the right permission to search them: the account needs the View-Only Audit Logs or Audit Logs role, which is assigned through a role group in the Purview portal (or via Exchange Online).

The one exception is the older, site-collection-level audit settings (Site Settings → Audit log reports) inherited from SharePoint Server. Those still exist but are largely superseded by the unified audit log, which is where current guidance - and this article - points you.

How to View the SharePoint Audit Log

The primary tool is the Audit solution in the Microsoft Purview portal (purview.microsoft.com):

1. Open the Purview portal and go to the Audit solution.
2. Start a new search. Set a date range, and optionally filter by activities (for example Accessed file, Downloaded file, Shared file, Deleted file), by user, or by the SharePoint site or file.
3. Run the search and review the results. Each record expands to show the full detail - the actor, the item, the timestamp, the IP address, and the client used.
4. Export to CSV when you need to sort, filter, or hand the evidence to someone else. The exported AuditData column is JSON; Excel Power Query can split it into readable columns.

This is enough for a one-off question. It is slower going when you are searching a wide date range or correlating activity across several users - the portal search runs asynchronously and can take time to return large result sets.

How to Search the SharePoint Audit Log with PowerShell

For anything repeatable or scripted, the underlying cmdlet is Search-UnifiedAuditLog, run from Exchange Online PowerShell. A typical SharePoint query looks like:

Search-UnifiedAuditLog -StartDate 06/01/2026 -EndDate 06/30/2026 `
  -RecordType SharePointFileOperation `
  -Operations FileAccessed,FileDownloaded,FileDeleted `
  -ResultSize 5000

You can narrow by user with -UserIds, by site or file with -ObjectIds, and pipe the output to Export-Csv. For the full syntax and connection steps, see SharePoint Online PowerShell.

Two practical limits to know: Search-UnifiedAuditLog returns a maximum of 5,000 records per call (you page through larger sets), and the data is unstructured JSON that you have to parse and interpret yourself - the cmdlet gives you raw events, not answers.

How Long Is the SharePoint Audit Log Kept?

Retention depends on your Purview Audit tier:

Audit tier	SharePoint / OneDrive audit retention
Audit (Standard)	180 days by default (records generated before 17 October 2023 kept for the old 90 days)
Audit (Premium) - E5 / equivalent	1 year by default for SharePoint, OneDrive, Exchange and Entra ID records
Audit (Premium) + add-on	Up to 10 years, via a per-user add-on licence and a custom retention policy

The important nuance: longer retention is licence-gated. Getting past 180 days means Audit (Premium), which needs E5 (or the standalone add-on), and getting to multi-year means a further per-user add-on plus a retention policy that only applies going forward - it cannot retroactively keep records you have already aged out. For a regulated organisation that needs years of activity history, that becomes a real cost and configuration exercise.

Where the Native SharePoint Audit Log Falls Short

The unified audit log is a solid system of record, but it was built to be searched after the fact, not to tell you when something is wrong. In practice, three gaps show up:

• It is data, not signal. The audit log will faithfully record a compromised account downloading thousands of files across sites at 2am - but nothing surfaces it. You only find it if you already know to go looking. There is no ranked alert, no "this is abnormal for this user."
• Searching it is slow and manual. The portal search lags on wide queries; Search-UnifiedAuditLog returns raw JSON in 5,000-record pages. Answering "show me everything this user did in the 30 days before they resigned" means exports, pivots, and analyst time.
• Retention is capped by licensing. 180 days on Standard, a year on E5, and multi-year only with add-on licences - and none of it lives in storage you control.

None of that is a flaw in the audit log; it is a system of record doing its job. It just is not a detection or investigation tool, and it is not where you want to be during an active incident.

From Audit Log to Alerting: Burrow

Burrow is the security half of SmiKar's Squirrel platform, built for exactly this gap. It watches the same SharePoint and Microsoft Entra ID audit stream your tenant already produces, and turns it from a firehose of raw events into a small, ranked feed of things worth acting on - as a subscription addon to the Squirrel platform, with no new infrastructure to provision.

Concretely, where the native audit log leaves you searching, Burrow:

• Turns events into ranked alerts. Behavioural baselines per user plus dozens of detection rules surface the encrypt-in-place fingerprint of ransomware, a contractor suddenly downloading many times their normal volume, an account signing in from a country it has never touched, or files being deleted in sites the user has not opened in months. Every alert carries the MITRE ATT&CK technique it maps to, so it drops straight into your incident-response runbook and compliance evidence pack.
• Explains each alert in plain English, without inventing anything. The detection engine computes the facts first - bytes downloaded, files touched, sites accessed - and the AI only phrases them; a verification step checks every number, name and timestamp against the source evidence before the alert is sent. It is AI you can quote in an audit report.
• Answers investigation questions in seconds with Hunt. Instead of paging through Search-UnifiedAuditLog output, Hunt gives one cross-entity search box: type a user, a date range, a file pattern, and get every matching event - then export it as CSV for the evidence pack. "Every file the former CFO accessed in the 30 days before she left" becomes a one-minute answer.
• Watches a departing employee automatically. Put a leaver under heightened monitoring the day they resign - the highest-risk window for data walking out the door - and Burrow surfaces activity it would normally quiet and emails a daily written report of everything they did until the watch expires.
• Keeps your audit history in your own Azure, for as long as you want. Burrow offloads the historical event store and cold-storage archives to your own Azure storage account. Retention is bounded only by how long you choose to keep paying object-storage cost - not by a Microsoft licence tier - and you own the record.

Burrow delivers its alerts by email to the addresses you nominate, tagged so they speak the same language as your existing SOC tooling. It is the layer that sits on top of the audit log and does the watching for you.

Frequently Asked Questions

How do I check the SharePoint audit log? Open the Audit solution in the Microsoft Purview portal, start a new search, set a date range, and filter by activity, user, or site. Your account needs the View-Only Audit Logs or Audit Logs role. For scripted or repeatable searches, use the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell.

Is the SharePoint audit log enabled by default? Yes. Microsoft Purview Audit (Standard) is on by default and captures SharePoint and OneDrive activity automatically. You only need the right role assigned to search it - you do not need to turn recording on.

How long is the SharePoint audit log retained? 180 days on Audit (Standard). Audit (Premium), included with E5, retains SharePoint, OneDrive, Exchange and Entra ID records for one year by default, and up to 10 years with a per-user add-on licence and a custom retention policy.

How can I see who accessed or deleted a file in SharePoint? Search the audit log for the Accessed file or Deleted file activities and filter by the file (ObjectId) or user. In the portal this is a manual search; a tool like Burrow answers the same question instantly through its Hunt activity search and can alert you proactively when the pattern looks like data theft.

Can the SharePoint audit log alert me when something looks wrong? No - the native audit log is a system of record, not a detection tool. It records events but does not rank them, baseline normal behaviour, or notify you. For ranked, MITRE-tagged alerting on your SharePoint and Entra ID audit activity, you need a layer on top such as Burrow.

See the Audit Trail Turned Into Signal

The SharePoint audit log tells you what happened, if you know to look. Burrow watches it for you - ranked alerts, plain-English explanations you can put in an audit report, and a search box that answers any activity question in seconds.

Talk to us about Burrow