How to Obtain Complete Audit Logs for a User's OneDrive in Microsoft Purview
Question details
The user needs to retrieve complete audit logs for activities in a specific user's OneDrive for Business using Microsoft Purview, but current searches return incomplete or zero results.
- Product
- Microsoft Purview and OneDrive for Business
- Device & OS
- not provided
- Scenario
- Searching for specific user activity logs in Microsoft Purview to track file, folder, and synchronization events in OneDrive.
- Observed behavior
- Searches using the standard OneDrive URL return incomplete data, such as only showing 'Viewed pages' activity, or fail to return any results at all.
Ensure you are dealing with a OneDrive for Business account and have the appropriate administrative permissions in Microsoft Purview, as personal consumer OneDrive accounts do not generate Microsoft 365 audit logs.
Modify the OneDrive URL in Purview Audit Search
Appending a specific layout suffix to the user's OneDrive URL often resolves the issue of missing audit data like file downloads.
When searching audit logs in Purview, using just the base URL of a user's OneDrive for Business often results in only 'Viewed pages' being logged. Modifying the URL ensures the search captures the full scope of file and folder activities.
Navigate to the Microsoft Purview compliance portal and open the Audit search tool.
In the search parameters, enter the specific user's name in the 'Users' box.
In the 'File, folder, or site' box, input the user's full OneDrive for Business URL and add '_layouts/15/onedrive.aspx' to the very end of it.
Click search to generate the logs. Verify that complete activities, such as 'Download file' and synchronization events, are now correctly returning in the results.
Cross-Test and Submit a Support Ticket
If modifying the URL fails to return complete logs, backend investigation by Microsoft support is necessary.
Discover WPS Office for Your Daily Productivity Needs
While Microsoft Purview handles complex enterprise compliance, WPS Office offers a free, lightweight, and highly compatible alternative for your everyday document creation. Enjoy a familiar tabbed interface and seamless migration without the heavy subscription fees.
- 1. Download the installer: Get the free WPS Office installer directly from the official WPS website.
- 2. Install and launch: Follow the simple on-screen instructions to install the suite on your computer.
- 3. Open existing files: Open your Word, Excel, or PowerPoint files instantly in WPS Office without worrying about formatting loss.
Frequently Asked Questions
Why are my Purview audit search results only showing 'Viewed pages'?
This is a common issue when searching with just the base OneDrive URL. To see the full scope of activities like file downloads, you need to append '_layouts/15/onedrive.aspx' to the end of the site URL in your search parameters.
Can I get audit logs for a personal OneDrive account?
No, Microsoft 365 audit logs are exclusively available for OneDrive for Business accounts. Personal consumer OneDrive accounts do not generate or support enterprise-level audit tracking.
What types of activities can be audited in OneDrive for Business?
OneDrive for Business supports comprehensive auditing, which includes tracking file creation and downloads, page views, folder modifications, and synchronization activities across the user's drive.
