Compliance Problems

How to Audit a Specific SharePoint File or Folder in Microsoft Purview

John Wilson Oct 21, 2026 868 views

Question details

The user needs to audit a specific SharePoint library, folder, or file using Microsoft Purview, but searches using the URL path return no results.

How to Audit a Specific SharePoint File or Folder in Microsoft Purview

Product: Microsoft Purview
Device & OS: not provided
Scenario: Searching for compliance audit logs for a specific document or directory within a SharePoint site.
Observed behavior: Microsoft Purview site-wide auditing works, but searching for a specific library, folder, or file using URL paths and wildcards yields no results.

Before you start

Ensure you have the appropriate administrative permissions, such as the View-Only Audit Logs role, assigned in Microsoft Purview to run compliance searches.

Solution 1Recommended

Search by File Name and Apply Filters

Since file-level URL searches may not function properly, the most effective method is to search by the exact file name and narrow down the results using Purview's filtering tools.

In Microsoft Purview, searching for specific SharePoint assets using direct URL paths or wildcards often fails to retrieve the targeted audit logs. Bypassing the URL path entirely and utilizing the file name keyword resolves this issue.

Access Microsoft Purview

Navigate to Audit

Select 'Audit' from the left-hand navigation menu to open the audit log search tool.

Input the File Name

In the search query fields, enter the exact name of the SharePoint file or folder you want to audit instead of pasting its URL.

Apply Filters

Use the available drop-down filters for date ranges, specific users, and SharePoint activity types (e.g., Accessed file, Modified file) to narrow down the broad file name results to your specific document.

Advanced Support: If you are still unable to retrieve the correct logs or need advanced audit-scope configurations, contact Microsoft Support for further guidance.

Free Microsoft Office alternative

Looking for a Lightweight Office Suite? Try WPS Office

While Microsoft Purview handles complex enterprise compliance and SharePoint auditing, your daily document editing shouldn't be complicated. WPS Office provides a free, lightweight, and highly efficient office suite tailored for seamless productivity.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx).Lightweight application footprint ensures fast startup and smooth operation.Familiar user interface requires no learning curve, enabling seamless migration.Built-in PDF editing combined with powerful word processing and spreadsheet tools.

microsoft office alternative - wps office

Frequently Asked Questions

Why does my Microsoft Purview search return no results when using a SharePoint URL?

File-level URL searches and wildcards in Microsoft Purview often do not map correctly to the backend audit logs for specific SharePoint paths. Searching by the exact file name and filtering the results is the proven workaround.

Can I audit an entire SharePoint site instead of a specific file?

Yes, Microsoft Purview auditing typically works flawlessly for an entire SharePoint site. You can input the root site URL in the search parameters to capture all recorded activities within that site.

What permissions do I need to search audit logs in Purview?

You must be assigned the 'View-Only Audit Logs' or 'Audit Logs' role in Exchange Online or Microsoft Purview to run and view audit log searches.

How long does it take for SharePoint activities to appear in the Purview audit log?

It can take anywhere from 30 minutes up to 24 hours for a newly generated SharePoint event to be processed and become searchable in the Microsoft Purview audit logs.

Microsoft Office Security Issues