How to Find SharePoint Online Users Modified in the Last Seven Days
Question details
Administrators need to identify which SharePoint Online user profiles have been modified or updated within the past seven days.
- Product
- SharePoint Online
- Device & OS
- not provided
- Scenario
- Tracking recent directory changes and user profile updates in a Microsoft 365 administrative environment.
- Observed behavior
- SharePoint Online user profiles do not natively provide a directly filterable date-modified field synchronized from Microsoft Entra ID, requiring the use of audit data to track changes.
Ensure you have the necessary administrator permissions to access the Microsoft Purview portal or Microsoft Entra ID (Azure AD) audit logs in your tenant.
Use the Microsoft Purview Unified Audit Log
The Purview unified audit log is the primary tool for searching user and directory activities across Microsoft 365.
Because SharePoint Online does not offer an out-of-the-box date-modified filter for user profiles, searching the unified audit log in Microsoft Purview is the recommended approach to identify recently updated users.
Go to the Microsoft Purview compliance portal (compliance.microsoft.com) and sign in with your administrator credentials.
In the left navigation pane, select 'Audit' to open the audit log search page.
Under the 'Search' tab, configure the Start and End date and time fields to cover the last seven days.
In the 'Activities' dropdown menu, search for and select activities related to updated users or directory changes.
Click 'Search'. Once the results load, you can export the matching events to a CSV file and use PowerShell or a database job to process only the affected users.
Review Microsoft Entra ID Audit Logs
Check the Entra ID audit logs directly in the Azure portal for user profile changes that synchronize to SharePoint.
Looking for a Lightweight Office Alternative?
While administrative tasks like auditing SharePoint users require Microsoft 365 admin centers, everyday document creation doesn't have to be expensive or heavy. WPS Office is a free, lightweight, and highly compatible alternative for opening, editing, and saving Word, Excel, and PowerPoint files.
- 1. Download WPS Office: Visit the official WPS website and download the installer for your operating system.
- 2. Install the application: Run the installer and follow the on-screen instructions to complete the setup process.
- 3. Open your documents: Launch WPS Office and directly open any existing Microsoft Office files to start editing immediately.
Frequently Asked Questions
Why can't I filter SharePoint users by modified date directly?
SharePoint Online user profiles do not natively provide a filterable date-modified field because profile data is synchronized from Microsoft Entra ID. Administrators must use audit logs to track recent modifications.
How long are audit logs retained in Microsoft Purview?
By default, Microsoft Purview retains audit logs for 180 days for standard licenses. If you only need to search for the last seven days, the default retention policy is more than sufficient.
Can I automate the export of recently modified users?
Yes, you can export the matching events from the Purview or Entra ID audit logs and use PowerShell scripts or a database job to process and filter only the affected users automatically.
