How to Investigate Unrecognized SharePoint File Activity
Question details
Users need to investigate why their SharePoint activity history shows files being created or edited under their name without their intentional modification.
- Product
- Microsoft SharePoint
- Device & OS
- not provided
- Scenario
- A user or administrator notices unexpected file activities, such as creations or edits, attributed to a specific user in SharePoint, raising concerns about potential unauthorized access or confusing system behavior.
- Observed behavior
- The SharePoint activity history records file uploads, edits, or creations under a user's name, even though the user did not actively perform those actions. This is often caused by background synchronization or file replacements.
Ensure you have Microsoft 365 administrator privileges, as accessing the Microsoft Purview compliance portal and audit logs requires admin permissions.
Review Microsoft Purview Audit Logs
Use the Microsoft Purview compliance portal to track the exact operations, timestamps, and IP addresses associated with the suspicious file activity.
Uploads, automatic synchronization, or the replacement of existing files can often generate unexpected creation and editing events in SharePoint. Checking the audit logs helps determine if the activity was an automated system process or initiated by an unauthorized party.
Log in to the Microsoft Purview compliance portal using your Microsoft 365 administrator credentials.
Navigate to the Audit section and run a search specifically for 'file and page activities' covering the timeframe of the suspicious events.
Carefully review the affected files, timestamps, user accounts, operations performed, and most importantly, the source IP addresses.
If you identify an unfamiliar or suspicious IP address in the log details, immediately change the affected user's Microsoft 365 password to prevent further unauthorized access.
Open a Microsoft 365 Support Request
If the audit logs are unclear or do not fully explain the unrecognized activity, escalate the issue to Microsoft Support for a deeper investigation.
Looking for a secure and lightweight Office alternative?
If you are experiencing ongoing complexities with Microsoft 365 administrative overhead, consider switching to WPS Office. It provides robust document management and full compatibility with Microsoft Office file formats in a lightweight, user-friendly, and free suite.
- 1. Download the installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the software: Run the installer and follow the simple on-screen instructions to set up WPS Office.
- 3. Open your documents: Launch WPS Office and instantly open your existing .docx, .xlsx, and .pptx files with perfect formatting.
Frequently Asked Questions
Why does a file show as edited when I only uploaded it to SharePoint?
If you upload a file to a SharePoint document library and it replaces or synchronizes with an existing file of the same name, SharePoint records this action as an 'edited' activity in the history logs.
Who can access Microsoft Purview audit logs?
Only users who have been assigned the appropriate administrator permissions within the Microsoft 365 admin center can access the Microsoft Purview compliance portal to run and view audit log searches.
What should I do if I find an unfamiliar IP address in the SharePoint audit logs?
If an unfamiliar IP address is associated with file activity on your account, you should treat it as a potential security breach. Immediately change your Microsoft 365 account password and notify your IT administrator.
Can background synchronization cause unexpected file activity logs?
Yes, background sync processes (like OneDrive sync clients updating local changes to SharePoint) can generate file creation or modification events in the activity history without the user actively clicking or editing the file online at that exact moment.
