Compliance Problems

Why OneDrive iOS App Shows FileDownloaded in SharePoint Audit Logs

WPS Editor Sep 30, 2026 869 views

Question details

Users or administrators are noticing that SharePoint audit logs record multiple 'FileDownloaded' activities when files are accessed or made available offline using the OneDrive app on iOS devices.

Why OneDrive iOS App Shows FileDownloaded in SharePoint Audit Logs

Product: SharePoint and OneDrive for iOS
Device & OS: iOS (iPhone/iPad)
Scenario: Reviewing SharePoint compliance audit logs after a user accesses documents or marks a folder for offline use on an iOS device.
Observed behavior: The audit log registers individual 'FileDownloaded' events for each file rather than a single bulk ZIP download event.

Before you start

Ensure you have the necessary Microsoft 365 administrative privileges to view and interpret SharePoint audit logs for your tenant.

Solution 1Recommended

Understand iOS Offline Sync Behavior

Recognize that individual 'FileDownloaded' logs are the expected system behavior when making files available offline on an iPhone or iPad.

When a user accesses SharePoint files or marks them for offline use via the OneDrive app on an iPhone or iPad, the iOS operating system processes these requests as individual file downloads.

Unlike desktop environments or certain web interfaces, iOS does not natively provide an option to select an entire library and download it as a single ZIP archive. Consequently, the OneDrive app must request each file one by one, which SharePoint accurately records as individual 'FileDownloaded' activities in the audit logs.

Review the Audit Logs

Log into the Microsoft Purview compliance portal and navigate to the Audit section to verify the individual 'FileDownloaded' entries corresponding to the user's iOS device.

Confirm User Activity

Verify with the user whether they recently used the OneDrive iOS app to view these files or tapped 'Make available offline' on a specific SharePoint folder.

Expected Behavior: This log pattern is completely normal and expected for the OneDrive iOS application. It does not inherently indicate a security breach or abnormal data exfiltration.

Solution 2

Escalate for Tenant-Specific Investigation

Steps to take if the volume or context of the downloads appears suspicious and requires administrative review.

Free Microsoft Office alternative

Easily Manage and Edit Your Documents with WPS Office

While resolving SharePoint audit log queries requires Microsoft 365 admin access, managing your daily documents doesn't have to be complicated. WPS Office provides a lightweight, reliable, and completely free alternative for creating, editing, and viewing your files on any device.

1. Download the App: Get WPS Office for free from the Apple App Store or the official WPS website for your desktop.
2. Sign In for Cloud Sync: Create a free account to securely sync your documents across your iPhone, iPad, and computer.
3. Open and Edit: Open your existing Word, Excel, and PowerPoint files directly in WPS Office without losing any of your original formatting.

Seamlessly view and edit documents on your iOS device, PC, or MacFully compatible with Microsoft Office formats, including DOCX, XLSX, and PPTXBuilt-in cloud storage for smooth, unified file syncing across all devicesLightweight installation with a familiar interface and zero learning curve

microsoft office alternative - wps office

Frequently Asked Questions

Why does the OneDrive iOS app download files individually instead of as a ZIP file?

The iOS operating system does not have a native mechanism to package an entire SharePoint library into a single ZIP archive for offline use. Therefore, the OneDrive app must request and download each file separately.

Does a 'FileDownloaded' entry mean my SharePoint data has been compromised?

Not necessarily. If a user intentionally accesses a file or marks a folder for offline availability on their iPhone or iPad, the system will accurately and automatically log this routine activity as 'FileDownloaded'.

Can administrators restrict offline file downloads on mobile devices?

Yes. Microsoft 365 administrators can enforce Conditional Access policies or use Microsoft Intune Mobile Application Management (MAM) to restrict offline access or prevent downloads on unmanaged mobile devices.

Microsoft Office Security Issues