Compliance Problems

How to Find Microsoft 365 Audit Logs for Downloaded Documents

Ayan Masood Oct 21, 2026 868 views

Question details

The user needs to identify documents downloaded by specific individuals within their organization and export those audit records for compliance or security review.

How to Find Microsoft 365 Audit Logs for Downloaded Documents

Product: Microsoft Purview (Microsoft 365)
Device & OS: not provided
Scenario: Monitoring internal data handling and tracking file download activities to ensure compliance and security.
Observed behavior: The goal is to successfully query Microsoft 365 audit logs to retrieve and export a list of 'FileDownloaded' activities filtered by specific users and date ranges.

Before you start

Ensure you have the appropriate administrative permissions in Microsoft Purview (such as the View-Only Audit Logs or Audit Logs role) and verify that auditing is enabled for your Microsoft 365 organization.

Solution 1Recommended

Search and Export Document Download Audit Logs in Microsoft Purview

Use the Audit search tool in the Microsoft Purview compliance portal to track and export user file download activities.

Microsoft Purview captures a comprehensive log of user and administrator activities. By filtering for specific download events, you can effectively monitor sensitive document handling.

Sign in to Microsoft Purview

Open your web browser and navigate to the Microsoft Purview compliance portal (compliance.microsoft.com). Sign in using your admin credentials.

Navigate to the Audit Tool

In the left navigation pane, scroll down and select 'Audit' to open the audit log search interface.

Configure Date Range and Activities

Set your desired 'Start date' and 'End date'. Click the 'Activities' dropdown, search for 'Downloaded file' (or 'FileDownloaded'), and select it to restrict the search to download events.

Specify Users

In the 'Users' field, type the names or email addresses of the specific individuals whose download activities you want to investigate.

Run Search and Export

Click 'Search' to run the query. Once the results populate, click the 'Export' button to download the audit log records as a CSV file for detailed analysis.

Search and Export Document Download Audit Logs in Microsoft Purview

Audit Log Retention Policies: The availability of historical audit records depends on your Microsoft 365 licensing and retention settings. Standard audit logs are typically retained for 90 or 180 days, whereas advanced auditing licenses may retain them for up to a year or longer.

Free Microsoft Office alternative

Discover WPS Office for Everyday Document Management

While Microsoft Purview handles complex enterprise compliance and auditing, WPS Office provides a free, lightweight, and highly compatible alternative for everyday document creation and editing tasks.

Fully compatible with Microsoft Office formats, including DOCX, XLSX, and PPTX.Lightweight design ensures fast installation and smooth performance on any computer or mobile device.A familiar, intuitive interface means no steep learning curve and seamless migration for your team.Built-in PDF tools make document conversion, editing, and annotation effortless.

microsoft office alternative - wps office

Frequently Asked Questions

Why can't I see any results when searching for downloaded files in Microsoft Purview?

This usually occurs if audit logging was not enabled for your Microsoft 365 tenant prior to the download events, or if the search date range falls outside of your license's audit retention period.

Who has permission to search audit logs in Microsoft Purview?

Only administrators or users explicitly assigned the 'View-Only Audit Logs' or 'Audit Logs' roles in Exchange Online or Microsoft Purview can access and perform searches within the audit logs.

Can I search for documents downloaded by guest users?

Yes. You can track file downloads initiated by external or guest users by entering their guest User Principal Name (UPN) or external email address in the 'Users' search field.

How long does it take for a download event to appear in the audit logs?

File activity events, such as downloading a document from SharePoint or OneDrive, typically take about 15 to 30 minutes to be processed and become searchable in the Microsoft Purview audit log.

Microsoft Office Security Issues