When you manage SharePoint Online it is important to have an understanding of the state of the SharePoint service.
Audit logs and usage reports could help you analyze and review SharePoint Online.
SharePoint Online could be a critical collaboration platform in Office 365. Every Communication site or Teams site could be a repository of important data and documents. In such cases, one of the SharePoint admin roles could be to manage audit logs and reports for heavily used SharePoint Online sites.
Learn how to use audit logs and usage reports in SharePoint Online.
SharePoint Online logs vs. ULS logs
Every person who was working with SharePoint Server knows ULS logs and the level of details you can find in these logs.
SharePoint Server was giving you the possibility to get very detailed access to the server logs that could be helpful in debugging, analysis, and reviews.
SharePoint Online does not offer the possibility to analyze the server logs for the SharePoint sites. You need to remember that SharePoint is a SaaS platform and you will have access to the reports and logs available in the user interface. In the SharePoint Server on-premise, you need to know the logs’ location. On SharePoint Online, you don’t need to know logs location. The user interface will present available logs.
There are usage reports and audit logs available on SharePoint Online. Learn how to use audit logs reports and user usage reports in SharePoint.
Audit logs SharePoint Online
SharePoint Online offers the possibility to analyze audit logs for the usage of the SharePoint online site.
How to configure SharePoint Online audit logs
SharePoint audit logs are turned on by design. You can review the setup on your SharePoint site by opening Settings (1) and Site information (2).
In the Site information, you will find the View all site settings option.
In the Site setting please select Site collection audit settings.
SharePoint site audit settings are deactivated in most cases. You will find there below information about the SharePoint audit logs:
- Given this audit experience is powered by the Unified Audit pipeline, we no longer support Trimming as a feature. You will be able to access files that have been trimmed so far in the document library that you have set for this purpose.
- We no longer support choosing specific events to edit. Audit Log Reports will still be available as usual but powered by the Unified Audit Pipeline. Please refer to this document for a complete list of audited events. Please note that we do not support list items as of now.
This is the current, by-design setup for the SharePoint Online audit logs setup.
How to view SharePoint Online audit logs
SharePoint Audit logs location is moved from SharePoint to a dedicated audit search portal in the Microsoft 365 compliance portal. You will find audit logs reports on the SharePoint site missing.
To open and view SharePoint Online audit logs visit: https://compliance.microsoft.com/auditlogsearch
On the Audit logs search, you will get access to a really great search engine that could help you to dig through the logs:
Available filters:
- Date and time range (1) – you can limit the time window which you want to use to investigate
- Activities (2) – you will have a huge list of activities available, like creating, uploading, accessing, viewing, delete on every element on the whole SharePoint structure. The list of available activities you can search for is huge.
- Users (3) – limit the results to the specific user
- File folder or site (4) – limit the investigation to the specific SharePoint site, document library, or specific folder – great feature!
☝️ Remember that logs are available for the last 90 days. You will need to have extended licenses to get access to longeer period of time.
Audit logs for the SharePoint present detailed information about all possible activities on the SharePoint site.
You can export all records from the SharePoint audit log to the CSV file or analyze them in the user interface record by record.
Because SharePoint audit logs return quite a complex set of data I would recommend to used search filtering or doing additional analysis in Excel.
Activities available in the SharePoint Online audit logs
The number of activities you can search in SharePoint Online audit logs is huge.
You will be able to find their logs for all:
- File and page activities
- Folder activities
- SharePoint list activities
- Sharing and access request activities
- Site permission activities
- Site administration activities
- and much more
Here you will find the full list of all available activities included in the SharePoint audit logs
Usage reports in SharePoint Online
SharePoint Online also allows you to analyze the usage of the SharePoint Online site. SharePoint user usage reports will deliver you data similar to Google Analytics but on a higher level of detail.
To access the usage reports for SharePoint Online open the Site settings (1) and select the Site usage (2).
In the SharePoint Site usage analytics you will get access to:
- Reports for the Hub site usage
- Reports for the single site usage
☝️ Remember that usage reports present data from the last 90 days.
SharePoint usage analytics contains reports, like:
- Unique viewers
- Site visits
- Avg time spent per user
- Popular content in last 7 days
- Site pages
- News posts
- Documents
- Usage insights
- By device
- By time
- Shared with external users
You can notice that not only this page contains usage statistics for the SharePoint site, but also visualize them in a nice way.
SharePoint data shared with external users
SharePoint usage analytics contains reports that could help you to monitor what content on your SharePoint site is shared with external users. You can check the permissions and access rights for every element like that or generate additional reports that save this information to CSV file.
The generated report could help you localize SharePoint files that are shared with external users.
Logs for deleted data in SharePoint Online
How to secure SharePoint critical data from unwanted removal? When you are working as an administrator of SharePoint Online you should also consider securing SharePoint data from unwanted removal. Deleting the data in SharePoint Online is quite easy and could happen that the user will remove more data than intent to.
SharePoint provides additional reports that allow you to analyze data moved to SharePoint Recycle Bin. Thanks to the retention features you have an additional 104 days to restore data held in the retention (90 days in SharePoint recycle bin).
Restore feature is available in SharePoint and OneDrive and allows to analyze who, when deleting what on the specific SharePoint library or OneDrive. This is a great analyzing tool that helps you to review deleted data.
Retention of the data could secure you in the area of securing data from unwanted removal. Microsoft 365 retention policies could extend the way how you retain or secure the data but if your SharePoint site will contain critical data you should consider a professional backup tool for Office 365 that will help you to restore data from a specific point in time.
AFI.AI who is a proud partner of this blog provides a fast and reliable backup platform for Microsoft 365. I recommend trying it for free.
What’s next?
Perfect! You have learned how to set up and use audit logs and usage reports. The next step could be to get to know more about SharePoint admin activities. Learn how to add SharePoint to file explorer, understand permissions and access rights in SharePoint and send newsletters from SharePoint Online.
Do you want to learn even more?
I prepared more articles that could help you get a better understanding of Power Automate, OneDrive, Microsoft Teams and Yammer.
Conclusion
SharePoint Online allows you to manage audit logs and usage reports to analyze SharePoint user’s access, usage, and logs.
