Compliance Problems

How to Audit Who Added or Deleted Files in SharePoint

Maira Mehtab Sep 27, 2026 869 views

Question details

The user needs to track and identify which users or accounts have added, deleted, modified, or accessed specific files within SharePoint.

How to Audit Who Added or Deleted Files in SharePoint

Product: Microsoft SharePoint / Microsoft Purview
Device & OS: not provided
Scenario: Monitoring file activities for compliance or security tracking in a SharePoint environment.
Observed behavior: Administrators and site owners need a detailed audit trail of file creation, deletion, and modification activities.

Before you start

Ensure you have the necessary Microsoft 365 administrator permissions or access to the Microsoft Purview compliance portal before attempting to run audit logs.

Solution 1Recommended

Use the Microsoft Purview Compliance Portal

The primary and most detailed method for tracking SharePoint file activities is using the Audit tool in Microsoft Purview.

Microsoft Purview records extensive logs of user activities across Microsoft 365. You can utilize its unified audit log to find exactly who created, modified, or deleted files within a specific timeframe.

Log in to Microsoft Purview

Navigate to the Microsoft Purview compliance portal and log in using your Microsoft 365 administrator credentials.

Open the Audit Tool

In the left-hand navigation pane, select the 'Audit' tab to open the audit log search page.

Configure the Search Criteria

Set the Start date and End date for the required date range you wish to investigate.

Filter by Activity and Site

Under 'Activities', search for and select 'SharePoint file and page activities'. Check specific actions like 'FileCreated' and 'FileDeleted'. You can also filter by a specific SharePoint site URL, username, or file name.

Search and Export

Click the 'Search' button. Once the results are generated, you can click 'Export' to download the audit logs as a CSV file for deeper analysis.

Use the Microsoft Purview Compliance Portal

Permission Required: If you lack audit permissions, you will not be able to view these logs. You must ask your organization's Microsoft 365 administrator to run this report for you.

Solution 2

Set Up SharePoint Alerts for Real-Time Notifications

If you want to track future additions or deletions as they happen, configure built-in SharePoint alerts on your document library.

Free Microsoft Office alternative

Manage Your Documents with WPS Office

While SharePoint and Microsoft Purview handle enterprise cloud compliance, you can handle your daily document creation and editing tasks effortlessly with WPS Office. It provides a lightweight, highly compatible, and cost-effective alternative to Microsoft Office for creating Word, Excel, and PowerPoint files.

1. Download and Install: Visit the official WPS website to download and install the free office suite on your preferred device.
2. Open Your Documents: Launch WPS Office and easily open your existing Microsoft Office files without losing formatting.
3. Edit and Save: Edit your documents, spreadsheets, and presentations, then save them in standard formats for easy uploading to SharePoint.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight installation and smooth performance on Windows, Mac, and Linux systems.Familiar user interface for a seamless migration from Microsoft Office.Free built-in PDF editing, conversion, and document management tools.

microsoft office alternative - wps office

Frequently Asked Questions

How long are SharePoint audit logs kept in Microsoft Purview?

By default, Microsoft 365 retains audit logs for up to 180 days for most standard licenses. Depending on your organization's enterprise licensing (such as E5), retention policies can be configured to hold logs for up to one year or longer.

Can a standard user view SharePoint audit logs?

No, standard users do not have access to the Microsoft Purview compliance portal. You must be an administrator with the appropriate audit permissions (such as the Audit Logs or View-Only Audit Logs role) to run these reports.

Is it possible to see exactly what content was modified inside the file using the audit log?

The audit log only tracks the action of modification (e.g., FileModified). To see the specific content changes made to the text or data, you need to review the file's Version History directly within the SharePoint document library.

What specific activities should I search for to find deleted files?

When configuring your audit search in Microsoft Purview, look specifically for the 'FileDeleted' and 'FileRecycled' activity tags under the SharePoint file and page activities section.

Microsoft Office Security Issues