SharePoint Document Issues

How to Find Files Created by a Specific User in SharePoint Online

Bushra Parveen Oct 22, 2026 869 views

Question details

SharePoint administrators need a reliable method to locate and identify all files created by a specific user account across Microsoft 365 locations.

How to Find Files Created by a Specific User in SharePoint Online

Product: SharePoint Online
Device & OS: not provided
Scenario: Tracking user activity and gathering specific documents generated by an individual user within an organization's SharePoint environment.
Observed behavior: Administrators need to retrieve a comprehensive list or export a detailed report of files generated by a targeted user account.

Before you start

Ensure you have the necessary administrative privileges in Microsoft 365 to access the Microsoft Purview compliance portal, and verify that audit logging is turned on for your organization.

Solution 1Recommended

Use the Microsoft Purview Audit Log

The most comprehensive way to find files created by a specific user across SharePoint and Microsoft 365 is by utilizing the audit log in the compliance portal.

This method searches across all indexed Microsoft 365 workloads and provides a detailed exportable report of user activities. It relies on audit logging being active during the timeframe in question.

Access the Compliance Portal

Log in to the Microsoft Purview compliance portal (compliance.microsoft.com) using your global administrator or compliance administrator credentials.

Navigate to Audit

In the left-hand navigation pane, scroll down and click on 'Audit' to open the audit log search interface.

Set the Date Range

In the 'Search' tab, use the 'Start date and time' and 'End date and time' fields to define the exact timeframe for your query.

Select the File Activity

Click the 'Activities' dropdown menu, scroll to 'File and page activities', and check the box next to 'Created file'.

Specify the Target User

In the 'Users' field, enter the email address or exact username of the specific user whose files you are tracking.

Run the Search and Export

Click the 'Search' button to run your query. Once the results populate, you can review the list of files or click 'Export' at the top to download the data as a CSV file for further analysis.

Audit Log Retention: By default, audit logs are retained for 180 days for standard Microsoft 365 licenses. If the files were created before this retention period, they may not appear in the search results.

Solution 2

Use SharePoint Site Search Syntax

A quick method to find files created by a user within a specific SharePoint site using targeted search queries.

Free Microsoft Office alternative

Use WPS Office for Your Daily Document Needs

While SharePoint and Microsoft Purview handle advanced organizational administration, WPS Office is an excellent, lightweight alternative for creating, editing, and managing your everyday documents locally or in the cloud. It's highly compatible with Microsoft Office formats and completely free.

1. Download WPS Office: Visit the official WPS website and download the free installer for your operating system.
2. Install the Suite: Run the installation file and follow the quick on-screen prompts to set up the software on your device.
3. Open Your Documents: Launch WPS Office and open your existing Microsoft Office files directly to continue working seamlessly.

Fully compatible with Microsoft Office file formats like .docx, .xlsx, and .pptx.Lightweight installation package with incredibly fast loading times.All-in-one suite to handle Word, Excel, and PowerPoint files in a single tabbed window.Free to download and use with a highly familiar, user-friendly interface.

microsoft office alternative - wps office

Frequently Asked Questions

Can I find files created by a deleted user in SharePoint?

Yes, as long as the files were created before the user account was deleted and audit logging was active during that specific time period, you can still search for their activities in the Purview audit log using their old email address.

How long are audit logs kept in Microsoft Purview?

For most standard Microsoft 365 subscriptions, audit logs are retained for 180 days by default. Organizations with advanced licensing (such as E5 or specialized add-ons) can retain logs for up to one year or longer.

Can I search for files modified by a user instead of just created?

Yes. In the Microsoft Purview audit log search interface, simply click the 'Activities' dropdown, navigate to 'File and page activities', and select 'Modified file' instead of 'Created file'.

Why is the Microsoft Purview audit log returning zero results?

This usually happens if audit logging was never enabled for your Microsoft 365 tenant, if you are searching outside the 180-day retention window, or if you lack the necessary compliance administrator permissions to view the logs.

Document & File Issues