Compliance Problems

Fix SharePoint Audit Log Showing System Account Instead of Users

Aamir Naveed Akram Sep 25, 2026 869 views

Question details

The SharePoint audit report fails to display individual user email addresses, instead showing 'System Account' in the User ID column.

Fix SharePoint Audit Log Showing System Account Instead of Users

Product: Microsoft SharePoint
Device & OS: not provided
Scenario: Reviewing SharePoint audit logs for compliance, page views, and edits to track user activity.
Observed behavior: The User ID column displays 'System Account' rather than the actual user's email address or identifier, preventing proper tracking.

Before you start

Ensure you have Microsoft 365 global administrator or SharePoint administrator privileges before attempting to review tenant policies or contact support.

Solution 1Recommended

Review Site Closure, Deletion, and Governance Policies

Check if recent policy changes in Microsoft 365 are masking user identities in the audit log.

Sometimes, specific governance settings, site closure policies, or retention rules can alter how SharePoint logs user activity. Verifying these policies is the first step in troubleshooting why user IDs are being replaced by the System Account.

Access the Microsoft 365 Admin Center

Navigate to Compliance or Purview

Go to the Microsoft Purview compliance portal to review active retention and site policies.

Check Site Policies

Look for recent site closure, deletion, or governance policies under the Data Lifecycle Management section that might have altered how user actions are logged.

Review Site Closure, Deletion, and Governance Policies

Policy Application Delay: Keep in mind that policy changes in Microsoft 365 can take up to 24 hours to fully propagate and reflect in audit log behavior.

Solution 2

Open a Support Request with Microsoft

If no policies explain the change, escalate the issue to Microsoft Support for a backend investigation.

Free Microsoft Office alternative

Boost Document Collaboration with WPS Office

While dealing with complex SharePoint and Microsoft 365 backend issues, you may need a reliable, hassle-free suite for your daily document work. WPS Office provides a lightweight, highly compatible alternative to Microsoft Office for creating, editing, and sharing documents without the administrative overhead.

1. Download WPS Office: Visit the official WPS website and click the download button to get the free installer.
2. Install the Software: Run the downloaded setup file and follow the simple on-screen instructions to install the suite on your device.
3. Open and Edit: Launch WPS Office and open your Microsoft Office files instantly with zero formatting loss.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight installation with a familiar, easy-to-use tabbed interface.Free to download and use for essential document creation and editing.Built-in PDF toolkit and cloud syncing for smooth cross-device collaboration.

microsoft office alternative - wps office

Frequently Asked Questions

Why does my SharePoint show System Account instead of my username?

This typically happens if a workflow, automated system process, or specific governance policy executes an action on behalf of the user, causing SharePoint to log the action under the System Account rather than the individual user.

Can I retrieve the actual user IDs for past events logged as System Account?

If the event was permanently written as 'System Account' due to a policy or backend glitch, you usually cannot retrieve the original user ID from the standard UI. Microsoft Support would need to check the backend telemetry to confirm if the data still exists.

Do I need admin rights to fix SharePoint audit log issues?

Yes, modifying compliance policies, accessing the Purview compliance portal, and raising a ticket with Microsoft 365 Support all require tenant administrator privileges.

Microsoft Office Security Issues