none
View Items events in audit log reports - SharePoint Online

    Question

  • Hello everyone,

    I've known that the "View Items" event is not available in the audit log report if I am using SharePoint Online. Now when I run an audit log search in the Security and Compliance Center (part of the O365 Service), I notice there is an activity called "Accessed File". Is this something I should utilize as a workaround for tracking who has viewed what documents?

    Thanks for the help!


    • Edited by Terry8023 Wednesday, June 22, 2016 11:38 PM
    Wednesday, June 22, 2016 11:21 PM

Answers

  • Yes, this one should work. Though sadly it catches a lot more than just documents, such as profile picture thumbnails and such. Used to be even worse though, it was showing CSS files, aspx and all the 'internals' :)
    • Marked as answer by Terry8023 Thursday, June 23, 2016 3:25 PM
    Thursday, June 23, 2016 5:21 AM

All replies

  • Yes, this one should work. Though sadly it catches a lot more than just documents, such as profile picture thumbnails and such. Used to be even worse though, it was showing CSS files, aspx and all the 'internals' :)
    • Marked as answer by Terry8023 Thursday, June 23, 2016 3:25 PM
    Thursday, June 23, 2016 5:21 AM
  • I liked it, you saw so much more about the internal structure of O365 than MS want you to. Did you know that Video Channels are configured as SharePoint site collections? I didn't until the Audit log...
    Thursday, June 23, 2016 7:40 AM
  • Thank you for your answer Vasil! Just a quick follow-up question - what is the timer job for the Security and Compliance Center? i.e how often does it catch up the user activities in SharePoint? I found this paragraph in Office Support Center (see the quote below), but it doesn't look like the log entry update that frequently, at least not in my tenant... 

    "It takes up to 15 minutes after an event occurs in SharePoint Online or OneDrive for Business for the corresponding audit log entry to be displayed. It takes up to 12 hours for events in Exchange Online and Azure Active Directory."

    Thursday, June 23, 2016 3:38 PM