Understanding SharePoint Audit Log Activities: ListItemViewed, ListViewed, and WACTokenShared
Question details
The user needs to understand the meaning of specific SharePoint audit log activities (ListItemViewed, ListViewed, WACTokenShared) and how to investigate them since they are not fully documented.
- Product
- Microsoft SharePoint
- Device & OS
- not provided
- Scenario
- Reviewing Microsoft 365 audit logs for security, compliance, or user monitoring purposes.
- Observed behavior
- Encountering undocumented audit log events (ListItemViewed, ListViewed, and WACTokenShared) without clear definitions in the official Microsoft documentation.
Ensure you have the necessary administrator permissions, such as Global Administrator or Compliance Administrator, to view and search audit logs in the Microsoft Purview compliance portal.
Interpret the Undocumented SharePoint Log Activities
Use community insights and logical deduction to understand what these specific SharePoint audit events mean in your tenant.
Microsoft frequently updates its backend services and telemetry, occasionally introducing new logging events before the public documentation is fully updated. Based on community discussions and logical naming conventions, these activities can be deduced.
This event typically indicates that a user navigated to and viewed a SharePoint list page within your environment.
This activity likely triggers when a user opens, clicks on, or views a specific individual item within a SharePoint list.
WAC stands for Web Access Companion, which is the underlying service name for Office Online. This event generally relates to Office on the web generating or sharing a session token for document viewing or co-authoring.
Open a Microsoft 365 Support Request
Since these activities lack official documentation, reaching out directly to Microsoft Support is the best way to get an authoritative explanation for a specific audit trace.
Looking for a simpler office solution? Try WPS Office
While SharePoint handles complex backend audit logs for enterprise environments, managing your daily documents doesn't have to be complicated. WPS Office provides a lightweight, free alternative to Microsoft Office that is fully compatible with Word, Excel, and PowerPoint formats.
- 1. Download the software: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install WPS Office: Run the installation file and follow the quick on-screen prompts to set up the software.
- 3. Open your files: Launch WPS Office and seamlessly open, edit, and save your existing Microsoft Office documents.
Frequently Asked Questions
Why are some SharePoint audit log activities not in the official documentation?
Microsoft frequently updates its Microsoft 365 backend services and telemetry. New logging events are often introduced into the system to improve monitoring before the public-facing documentation is fully updated to reflect them.
What does WAC stand for in Office 365 audit logs?
WAC typically stands for Web Access Companion. It is the underlying service name for Office Online (such as Word, Excel, and PowerPoint on the web). Events containing 'WAC' usually relate to browser-based document interactions.
How can I view SharePoint audit logs?
You can search and view audit logs by visiting the Microsoft Purview compliance portal. Navigate to the 'Audit' solution on the left sidebar, define your date range, and run a search for specific SharePoint activities.
