How to Track File Audit Logs in SharePoint 365

Step 1: Enable Audit Logging in SharePoint Online

1. Sign in to the Office 365 Admin Center:

• Open a web browser and sign in to the Office 365 Admin Center using an account that has Administrator or Global Administrator rights for your organization.

2. Navigate to the Security & Compliance Center:

• Select Admin centers from the left-hand menu and click on Security & Compliance.

3. Open Audit Settings:

• In the Security & Compliance Center, click on Auditing in the left-hand menu.

4. Configure Audit Logging:

• Click on Audit log search or File audit log settings based on your configuration needs (Audit log search is for general auditing searches; File audit log settings is for file auditing settings).
• Select Start recording user and admin activities to enable audit logging.

5. Select Download Audit:

• In the Audit log settings page, check for Activities or Events related to file downloads such as File Download or Download.
• Specify audit conditions as needed (e.g., user downloading, date, file type, etc.).

 

Step 2: Access Audit Logs and Search Logs

1. Search Audit Logs:

• In the Security & Compliance Center, click on Search & investigation in the left-hand menu.
• Choose Audit log search or File audit log search as required for your search.
• Define search criteria such as desired time range, user performing downloads, file names, etc.

2. View Download Details:

• After performing the search, you’ll see a list of download activities that match your specified criteria.
• Click on each entry to view more details such as the downloader, date and time, and file details.

 

Step 3: Management and Analysis

1. Analysis and Reporting:

• Use data from Audit Logs to analyze and create reports on file downloads.
• Create graphs or reports to illustrate usage trends and related risks.

2. Improvement and Maintenance:

• Utilize data from Audit Logs to improve security policies and file management in your organization moving forward.”