How to Find the Device That Synced a SharePoint or OneDrive File
Question details
Administrators need to identify the specific computer or device that first synchronized files from a SharePoint document library using audit events.
- Product
- SharePoint and OneDrive
- Device & OS
- not provided
- Scenario
- Tracking file synchronization activity and device identification in Microsoft 365 compliance center.
- Observed behavior
- Microsoft 365 audit logs, including the FileSyncDownloadedFull event, do not currently provide a reliable field to identify the original synchronization device.
Log in to the Microsoft 365 Purview compliance portal with administrator credentials to review your organization's available audit logs.
Understand Microsoft 365 Audit Log Limitations
Currently, it is not possible to trace the exact device that synced a file using standard Microsoft 365 audit logs.
While administrators can use the FileSyncDownloadedFull audit event to see that a file was downloaded via synchronization, the Microsoft 365 audit record does not currently contain a reliable field that identifies the original synchronization device.
It is not possible to directly match these sync events with an Endpoint Manager, Microsoft Defender for Endpoint, or Azure Active Directory device object. Administrators needing this feature must submit feedback to Microsoft.
Navigate to the Microsoft Purview compliance portal, select 'Audit' from the left navigation pane, and search for the 'FileSyncDownloadedFull' activity to view user sync behaviors (note that device ID will be missing).
Go to the Microsoft 365 Security and Compliance Feedback portal or UserVoice forum to submit a request for device identification capabilities in SharePoint audit logs.
Manage and Edit Your Synced Documents with WPS Office
While managing enterprise audit logs is specific to Microsoft 365 administration, editing the actual files synced from SharePoint or OneDrive doesn't require an expensive Office subscription. WPS Office is a free, lightweight, and user-friendly alternative that perfectly handles your document management needs.
- 1. Download and Install: Visit the official WPS website, download the free installer, and complete the lightweight installation process on your PC or Mac.
- 2. Access Synced Files: Open WPS Office and navigate to your local OneDrive or SharePoint sync folder to select the documents you wish to edit.
- 3. Edit and Save: Use the robust built-in Writer, Spreadsheet, and Presentation tools to edit your files. Changes are saved back to your sync folder automatically.
Frequently Asked Questions
Can I use the FileSyncDownloadedFull event to find a device name?
No. The FileSyncDownloadedFull audit event tracks that a file was downloaded via a synchronization client, but it does not capture or report the specific device name or hardware ID.
Does Azure Active Directory track which device synced OneDrive files?
Azure AD tracks user sign-ins and authentications from registered devices, but it does not correlate these sign-ins directly with specific file sync events in SharePoint or OneDrive document libraries.
Will Microsoft add device tracking to SharePoint audit logs in the future?
Microsoft continually updates its security and compliance features based on user feedback. Administrators are encouraged to request this tracking feature directly through the Microsoft Feedback portal to increase its priority.
