SharePoint Online: How to Track Document Downloads from Audit Log?

Requirement: Track document downloads in SharePoint Online.

How to Audit Downloads in SharePoint Online?

Do you need to keep track of who is downloading your SharePoint Online documents? Are you looking for a way to track document downloads from Audit Log in SharePoint Online? In this guide, we will show you how to do just that. We will walk you through the steps of tracking who is downloading which documents and when using Audit Log and PowerShell scripts. Let’s get started!

We got a requirement to audit all files downloaded from a specific SharePoint Online site collection. Here are the steps to query audit logs for SharePoint Online:

  1. Login to Microsoft 365 compliance site at
  2. Click on the “Audit” link on the left navigation (URL:
  3. Select the date range, and Set the “Activities” dropdown to “Downloaded file” under “File and page activities”. Optionally, you can set the filter to “File, folder, or site”.
  4. Click on “Search” button to initiate the audit log search.sharepoint online track document downloads

The audit log report will show a list of all the download events that match your filters, along with details such as the date and time of the event, the user who performed the action, and the file that was downloaded. In our case, based on the filters specified, It gets you all download activities of documents from SharePoint Online along with details such as Date Timestamp, IP Address, User ID, What Item was downloaded, etc. You can export the results to a CSV as well.

audit downlods in sharepoint online

PowerShell to Get Audit Logs for SharePoint Online

We can also query the unified log using PowerShell. Here is the PowerShell script to automate the above steps:

#Connect to Exchange Online
Connect-ExchangeOnline -Credential (Get-Credential)

#Set Date Filters - past 7 days!
$StartDate = (Get-Date).AddDays(-7)
$EndDate = Get-Date

#Search Unified Log
$SharePointLog = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -Operations "FileDownloaded"
$AuditLogResults = $SharePointLog.AuditData | ConvertFrom-Json | Select CreationTime,UserId,Operation, ObjectID,SiteUrl,SourceFileName,ClientIP

#Export Audit log results to CSV
$AuditLogResults | Export-csv -Path "C:\Temp\SPAuditLog.csv" -NoTypeInformation

Disconnect-ExchangeOnline -Confirm:$false


In summary, to track document downloads in SharePoint Online, You can query compliance audit logs either through the web browser interface or using PowerShell. The audit logs contain who has downloaded what documents and when they were downloaded. This information can be useful for compliance purposes, as it allows you to track who has accessed sensitive or confidential documents. Additionally, you can set up alerts to notify you when certain actions, such as downloads, take place, which can help you stay informed about activity on your SharePoint site.

Overall, tracking document downloads in SharePoint Online through compliance audit logs is an effective way to ensure that your site is being used appropriately and in compliance with any relevant regulations or policies.

Salaudeen Rajack

Salaudeen Rajack - Information Technology Expert with Two decades of hands-on experience, specializing in SharePoint, PowerShell, Microsoft 365, and related products. Passionate about sharing the deep technical knowledge and experience to help others, through the real-world articles!

2 thoughts on “SharePoint Online: How to Track Document Downloads from Audit Log?

  • My users are showing up with some Microsoft user ID that is just numbers and letters.
    If I click on the entry, I can figure out who downloaded what, but can see their name on the list that can be exported.
    Any ideas how to change the names to match how I recognize my users?

  • We need to know when a non-licensed user (for example an external customer) downloads a shared file. Will the above method work?


Leave a Reply

Your email address will not be published. Required fields are marked *