How to Restrict SharePoint Audit Searches by User or Site Collection
Question details
The user wants to restrict audit log searches so that specific delegates can only search and view audit records for particular SharePoint site collections, without gaining access to Outlook or Teams audit data.
- Product
- SharePoint Online / Microsoft 365
- Device & OS
- not provided
- Scenario
- Delegating compliance and audit reporting tasks to restricted users or site administrators without granting tenant-wide data visibility.
- Observed behavior
- Standard Microsoft 365 audit permissions grant tenant-wide access across workloads, allowing users with audit roles to search everything, including Outlook and Teams, rather than restricting them to specific SharePoint site collections.
Ensure you have Microsoft 365 Global Administrator or Exchange Online Administrator privileges before modifying compliance roles and audit search permissions.
Manage Audit Log Roles in Exchange Online
Since site-specific audit scoping is not natively supported, restrict the broad 'View-Only Audit Logs' role strictly to authorized compliance officers.
Microsoft 365 currently does not natively support scoping audit log searches to specific SharePoint site collections. When a user is granted the Audit Logs or View-Only Audit Logs role, they can query the unified audit log across all supported M365 workloads, including Exchange (Outlook) and Teams.
To maintain security, limit these roles to a small group of trusted administrators and avoid assigning them to standard site owners.
Sign in to the Microsoft 365 admin center and navigate to the Exchange admin center.
Click on 'Roles' in the left navigation pane and select 'Admin roles'.
Search for 'Compliance Management' or create a custom role group containing the 'View-Only Audit Logs' role. Ensure only authorized tenant-level compliance users are added to the 'Assigned' list.
Implement Custom SharePoint Reporting using PnP Modern Search
Create a site-scoped custom reporting dashboard as a workaround for users who only need to see activity within specific SharePoint sites.
Looking for a Cost-Effective Document Solution?
While managing SharePoint compliance requires Microsoft 365 admin access, your team doesn't always need an expensive Microsoft subscription for everyday document editing. WPS Office is a free, lightweight, and powerful alternative for handling word processing, spreadsheets, and presentations.
- 1. Download and Install: Get WPS Office for free from the official website and install it on your Windows, Mac, or Linux device.
- 2. Open Existing Documents: Open any existing Microsoft Word, Excel, or PowerPoint files directly in WPS Office without formatting loss.
- 3. Edit and Save Seamlessly: Edit your documents with advanced tools and save them in standard Office formats to share with your team easily.
Frequently Asked Questions
Can I restrict Microsoft 365 audit log searches to a single SharePoint site?
No, natively Microsoft 365 does not provide site-specific scoping for the unified audit log. Roles like 'View-Only Audit Logs' apply tenant-wide and grant visibility into Exchange, Teams, and all SharePoint sites.
How can site owners view recent activity without audit log permissions?
SharePoint site owners can use the built-in 'Site Usage' page or add the 'Site Activity' web part to their homepage. This provides visibility into recent file modifications and views specific to their site without requiring tenant-wide compliance roles.
Does granting SharePoint Administrator rights give access to the audit log?
No, the SharePoint Administrator role manages site configurations, storage, and user access but does not automatically grant access to the Microsoft 365 Purview compliance audit logs. Audit log access requires assigning specific Exchange or Compliance roles.
