Can Audit Logs Be Enabled for a Single SharePoint Subsite?
Question details
The user wants to know if it is possible to enable audit logging exclusively for one specific SharePoint subsite rather than the entire environment.
- Product
- Microsoft SharePoint
- Device & OS
- not provided
- Scenario
- Monitoring user activity and compliance for a specific SharePoint subsite without capturing or navigating through global audit data for the entire site collection.
- Observed behavior
- Microsoft Purview auditing does not allow enabling logs for selected subsites exclusively; instead, users must utilize global audit logs and filter the data by the specific site URL.
Ensure you have the necessary administrative permissions in the Microsoft Purview compliance portal to access, search, and export global audit logs.
Search and Filter Microsoft Purview Audit Logs by Site URL
Since you cannot enable auditing for just one subsite, the standard approach is to use Microsoft Purview to search all logs and filter the results using the specific subsite URL.
Microsoft Purview records audit data globally for your SharePoint environment. To isolate activities for a single subsite, you must perform a global audit log search and restrict the query to that subsite's specific web address.
Log in to the Microsoft Purview compliance portal using your global admin or compliance admin credentials.
Navigate to the 'Audit' tool from the left-hand navigation pane.
Set your desired date range and activities. In the 'File, folder, or site' field, enter the exact URL of the specific SharePoint subsite you want to audit.
Click 'Search' to run the audit log query. Once the results load, you can export them to a CSV file to view activity strictly related to that subsite.
Looking for a Lightweight Office Suite? Try WPS Office
While enterprise compliance and SharePoint management require Microsoft tools, everyday document creation and editing doesn't have to be heavy or expensive. WPS Office is a free, lightweight, and highly compatible alternative to Microsoft Office that easily handles Word, Excel, and PowerPoint files.
- 1. Download WPS Office: Visit the official WPS website and click 'Download WPS Office Free' to get the installer.
- 2. Install the Software: Run the downloaded installer and follow the quick on-screen instructions to set up the suite on your device.
- 3. Open Your Documents: Launch WPS Office and seamlessly open your existing Microsoft Office files or exported CSV audit logs without losing any formatting.
Frequently Asked Questions
Why can't I enable auditing for just one SharePoint subsite?
Microsoft Purview is designed to handle auditing centrally at the tenant level to ensure comprehensive security and compliance. Granular enablement at the subsite level is not supported; instead, filtering search results by URL is the intended method.
Is the old SharePoint site audit log feature still available?
No, the legacy SharePoint site audit log feature has been deprecated and is no longer supported. All auditing tasks must now be performed through the Microsoft Purview compliance portal.
How long does Microsoft Purview retain SharePoint audit logs?
By default, Audit (Standard) retains logs for 180 days. Organizations with Audit (Premium) licenses can retain logs for up to one year, with options to extend retention policies up to 10 years depending on their specific subscription.
Can I export the filtered audit log results for further analysis?
Yes, once you have filtered the Microsoft Purview audit logs by your SharePoint subsite URL, you can export the results to a CSV file and analyze them in spreadsheet software like WPS Spreadsheet or Excel.
