SharePoint Online: How to Track Document Downloads from Audit Log?

Requirement: Track document downloads in SharePoint Online.

How to Audit Downloads in SharePoint Online?

We got a requirement to audit all files that are downloaded from a specific SharePoint Online site collection. Here are the step to query audit logs for SharePoint Online:

  • Login to Microsoft 365 compliance site at https://compliance.microsoft.com
  • Click on “Audit” link on the left navigation.
  • Select the date range, Set the “Activities” dropdown to “Downloaded file” under “File and page activities”. Optionally, you can set the filter on “File, folder, or site”.
  • Click on “Search” button to initiate the audit log search.sharepoint online track document downloads

This gets you all download activities of documents from SharePoint Online along with details such as Date Timestamp, IP Address, User ID, What Item was downloaded, etc. You can export the results to a CSV as well.

audit downlods in sharepoint online

PowerShell to Get Audit Logs for SharePoint Online

We can also query the unified log using PowerShell. Here is the PowerShell script to automate the above steps:

#Connect to Exchange Online
Connect-ExchangeOnline -Credential (Get-Credential)

#Set Date Filters - past 7 days!
$StartDate = (Get-Date).AddDays(-7)
$EndDate = Get-Date

#Search Unified Log
$SharePointLog = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -Operations "FileDownloaded"
$AuditLogResults = $SharePointLog.AuditData | ConvertFrom-Json | Select CreationTime,UserId,Operation, ObjectID,SiteUrl,SourceFileName,ClientIP

#Export Audit log results to CSV
$AuditLogResults
$AuditLogResults | Export-csv -Path "C:\Temp\SPAuditLog.csv" -NoTypeInformation

Disconnect-ExchangeOnline -Confirm:$false

Salaudeen Rajack

Salaudeen Rajack is a SharePoint Architect with Two decades of SharePoint Experience. He loves sharing his knowledge and experiences with the SharePoint community, through his real-world articles!

Leave a Reply