Four methods exist for pulling SharePoint Online audit activity out of Microsoft 365 and into a file you can analyse. Here is how they compare at a glance:
| Method | Access Required | Max Date Range | Multi-Site | Export Format | Cost |
|---|---|---|---|---|---|
| Native admin center export | Audit Logs role | 90 days (E3) / 1 year (E5) | Yes | CSV | Included |
| PowerShell (Search-UnifiedAuditLog) | Audit Logs role | 90 days (E3) / 1 year (E5) | Yes | CSV (via Export-Csv) | Included |
| Microsoft Purview Compliance portal | Compliance Admin role | 90 days - 10 years (licence dependent) | Yes | CSV | Purview licence required for >90 days |
| ShareMaster Report Master | SharePoint Admin / Global Admin | Within your tenant's retention period | Yes | Excel (.xlsx) | ShareMaster paid licence |
How SharePoint Online Audit Logging Works
SharePoint Online activity is captured in the Microsoft 365 unified audit log, the same log that records events from Exchange Online, Microsoft Teams, OneDrive for Business, and other M365 services. Every time a user or administrator takes an action that SharePoint is configured to log - viewing a file, downloading a document, changing permissions, deleting an item, accessing a site - an event record is written to the audit log with the user's identity, timestamp, site URL, item path, and activity type.
Audit logging is enabled by default for all Microsoft 365 Business and Enterprise subscriptions. You do not need to turn it on. What varies between plans is how long those records are retained: 90 days for Microsoft 365 E3 and below, one year for E5, and up to ten years with Microsoft Purview Audit (Premium) licences.
The data source is the same regardless of which export method you use. The differences between methods lie in scope, filtering, volume limits, and the format of what you get out.
Option 1: Native Audit Log Export from the Microsoft 365 Admin Center
What it covers
The Microsoft 365 compliance portal (compliance.microsoft.com) provides a built-in audit search UI at Audit > Search. Select an activity type, a date range, and optionally a user or site URL, then run the search and export the results to CSV directly from the results page.
This is the right starting point for one-off investigations: "What happened to this document on this date?" or "Which user accessed this library last week?" The interface is interactive and requires no scripting knowledge.
Limitations
- 150-result UI preview. The audit search UI shows up to 150 results in the preview pane. The export file contains the full result set, but you must export to see all records beyond the first 150.
- 50,000-row export limit. A single search export is capped at 50,000 records. For large tenants where high-volume activities (file views, sync operations) are included, a single day's activity across all sites can easily exceed this limit.
- Manual date range selection. Each export covers one search query. Retrieving 90 days of activity across a large tenant requires multiple exports and manual stitching in Excel.
- No scheduling. The native UI does not support automated or scheduled exports. Every export is a manual action.
Option 2: PowerShell - Search-UnifiedAuditLog
When it works well
The Search-UnifiedAuditLog cmdlet from the Exchange Online PowerShell module gives you programmatic access to the same audit data. You can loop through date ranges, filter by RecordType, and pipe output to Export-Csv to build larger datasets than the UI allows.
PowerShell is the right choice when you need to automate a regular extract, build a custom report combining SharePoint events with data from another source, or retrieve more than 50,000 records by splitting date ranges into smaller windows. PnP PowerShell provides additional SharePoint-specific cmdlets that complement the unified audit log access.
Limitations
- 5,000-result ceiling per call. A single call to
Search-UnifiedAuditLogreturns a maximum of 5,000 results. To retrieve more, you must loop through the date range in smaller windows or use theSessionIdandSessionCommandparameters to page through large result sets. - Throttling. The API applies throttling under sustained high-volume queries. Scripts that loop too aggressively will encounter 429 responses and need retry logic with exponential back-off.
- Scripting knowledge required. This approach is not suitable for administrators without PowerShell experience. Setup, session management, and error handling add complexity.
- JSON-in-AuditData field. The detail of each event is returned as a JSON string in the AuditData property, which must be parsed separately to extract fields like site URL, file name, or specific operation details.
Option 3: Microsoft Purview Compliance Portal
Microsoft Purview Audit (available inside the compliance portal) goes beyond the basic audit search to offer retention up to ten years (with the appropriate add-on licence), near-real-time availability of audit records (a few minutes vs up to 24 hours for standard audit), and access to a broader range of events including high-value security events not available in standard audit.
Purview Audit is the right tool for regulated industries that require long audit trails, or for security teams conducting forensic investigations that need events from months or years ago. For recurring formatted reports - weekly permissions summaries, activity digests for management - a purpose-built report tool handles this better.
The export format from Purview is CSV, identical to the native admin center export. It requires Compliance Administrator or higher in Entra ID and, for retention beyond 90 days, a Microsoft Purview Audit (Premium) licence or a Microsoft 365 E5 licence.
See what Report Master exports automaticallyOption 4: ShareMaster Report Master
Report Master is the SharePoint-specific reporting module in ShareMaster. Where the previous three options give you raw audit log data in CSV format, Report Master provides structured, formatted Excel exports designed for the specific reporting tasks SharePoint admins face most often: who accessed what file and when, which permissions changed on which libraries, which files were deleted by which user, and how storage is distributed across site collections.
Key differences from the raw audit log approaches:
- Excel output with named columns. No JSON parsing or CSV cleanup required. The exported workbook has readable column headings, date formatting, and data already shaped for pivot tables or direct sharing with stakeholders.
- Pre-built report types. Permissions matrix reports, version count reports, storage utilisation reports, and activity exports are available as named report types with their own filter options - you do not need to translate SharePoint event types or build your own queries.
- Cross-site reporting in one pass. Report Master connects to the tenant and can pull data from multiple site collections in a single report run, without requiring multiple query loops or manual stitching of CSV files.
- No Purview licence required. Report Master works within the standard SharePoint Online APIs available to SharePoint administrators. You do not need a Microsoft 365 E5 or Purview Audit Premium licence to generate SharePoint-specific activity reports.
For the full list of available report types, see the guide to exporting SharePoint permissions to Excel.
Decision: Which Method for Which Scenario
| Scenario | Best Option |
|---|---|
| One-off investigation: who deleted a specific file? | Native admin center audit search |
| Recurring weekly or monthly activity report for management | Report Master (formatted Excel output) |
| Large-scale extract: 30 days of all activity across all sites | PowerShell (Search-UnifiedAuditLog with date-range loops) |
| Forensic investigation requiring events from 6-12 months ago | Microsoft Purview (requires E5 or Purview Audit Premium) |
| Compliance audit: permissions and access across all site collections | Report Master (permissions matrix export) |
| Security operations team needing real-time alert data | Microsoft Purview with alert policies |
| Admin with no scripting skills, needs a quick CSV of last week's file deletions | Native admin center export |
| Regular activity export to Excel without PowerShell scripting | Report Master (run manually by the admin) |
Frequently Asked Questions
How long does SharePoint Online keep audit logs?
SharePoint Online audit log retention depends on your Microsoft 365 plan. E3 and below retain logs for 90 days. E5 retains them for one year by default. With a Microsoft Purview Audit (Premium) licence, retention can be extended up to ten years. You cannot retrieve events older than your tenant's retention period regardless of which export method you use.
What admin role do I need to export the SharePoint audit log?
Exporting from the Microsoft 365 compliance center or via Search-UnifiedAuditLog requires the Audit Logs or Compliance Administrator role in Entra ID. Global Administrators also have access. SharePoint Administrator alone is not sufficient for unified audit log access.
Can I export SharePoint audit logs to Excel?
Yes. All four methods produce data that opens in Excel. The native export, PowerShell, and Purview produce CSV files. ShareMaster Report Master exports directly to a formatted Excel workbook with named columns and date formatting already applied.
Does the SharePoint audit log track who deleted a file?
Yes. SharePoint Online logs a FileDeleted event whenever a user or administrator deletes a file. The event includes the user's UPN, the file name and path, the site URL, and a timestamp. This event is captured even if the file is subsequently restored from the recycle bin.
For a detailed walkthrough of running your first audit log export, see how to export the SharePoint audit log to Excel.
Try ShareMaster free for 14 days