Compliance Problems

How to Generate OneDrive Audit Logs: Admin Guide

Maira Mehtab Sep 28, 2026 869 views

Question details

Administrators need to create and review audit logs for OneDrive activity to monitor file access, sharing, downloads, and deletions.

Product: OneDrive / Microsoft Purview
Device & OS: not provided
Scenario: Tracking and reviewing user activities for compliance and security monitoring.
Observed behavior: Generating a comprehensive audit log report of OneDrive activities within a specific date range.

Before you start

Ensure you have the required audit or compliance administrator permissions assigned in your Microsoft 365 organization before attempting to access the Microsoft Purview portal.

Solution 1Recommended

Generate Audit Logs via Microsoft Purview Portal

Use the unified Audit tool in Microsoft Purview to track OneDrive and SharePoint activities across your organization.

The Microsoft Purview portal provides a centralized location for compliance administrators to search the unified audit log. This log contains records of user and administrator activities across your Microsoft 365 services, including detailed OneDrive events.

Access Microsoft Purview

Sign in to the Microsoft Purview compliance portal using an administrator account with the necessary audit or compliance permissions.

Navigate to Audit

On the left navigation pane, locate and select the 'Audit' tab to open the audit log search tool.

Set Search Criteria

Choose the appropriate date and time range for your search. Under the 'Activities' dropdown, select the specific file and folder actions you want to track, such as accessed, downloaded, or deleted files.

Filter by Workload

Set the workload filter to 'OneDrive' and 'SharePoint' to narrow down the results. You can also specify certain users or site URLs if needed.

Run and Export

Click 'Search' to generate the log. Once the search completes, click 'Export' to download the results as a CSV file for detailed analysis.

Log Retention Period: Audit log records are retained and searchable for a limited time based on your Microsoft 365 subscription tier, typically ranging from 180 days to 1 year.

Free Microsoft Office alternative

Looking for a fast, cost-effective alternative to Microsoft Office?

While Microsoft Purview handles complex enterprise compliance for OneDrive, many users simply need a reliable, lightweight suite for daily document editing. WPS Office offers a free, highly compatible alternative to Microsoft Office with built-in integration for cloud storage providers.

1. Download and Install: Download WPS Office for free from the official website and install it on your computer or mobile device.
2. Connect Cloud Storage: Open WPS Office, go to the 'Open' menu, and select 'Add Cloud Storage' to securely link your OneDrive account.
3. Edit Files Directly: Open, edit, and automatically save your Office documents directly back to your connected cloud drive without complex syncing processes.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Seamlessly connects to cloud services like Google Drive, Dropbox, and OneDrive for easy file access.Lightweight software design ensuring fast startup times and minimal system resource consumption.Includes an advanced PDF editor for viewing, editing, filling forms, and converting PDF files.

microsoft office alternative - wps office

Frequently Asked Questions

Who can generate OneDrive audit logs?

Only administrators who have been assigned specific Audit Logs or View-Only Audit Logs roles in the Microsoft Purview portal can generate and view these security logs.

How long does it take for OneDrive activities to appear in the audit log?

Most OneDrive and SharePoint activities typically appear in the unified audit log within 15 to 30 minutes of the event occurring, though it can occasionally take up to 24 hours depending on the Microsoft tenant load.

Can I track when a specific file was downloaded in OneDrive?

Yes, by filtering the audit log search activities to 'Downloaded file' and specifying the file name or URL in the search criteria, you can track exactly when and by whom the file was downloaded.

Why is my audit log search returning no results for OneDrive?

Ensure that unified audit logging is actively turned on for your Microsoft 365 organization. If it was recently enabled, it may take a few hours before new events are recorded and become searchable.

Microsoft Office Security Issues