Storage growth

Which sites grew and who uploaded it

For the day the storage figure jumps and someone asks where it went. One read-only run answers three questions: which sites grew, who uploaded what and where, and what the most-grown sites' space is made of. It never scans every file in the tenant: the Microsoft 365 audit log already records who uploaded what.

What it tells you

• Every site's storage now, beside an earlier figure and the change, ranked by growth. The earlier figure is this report's own last run, or Microsoft's usage report when there is no last run.
• Every file uploaded in the period, from the Microsoft 365 audit log: who, which site, when, and how large, each file listed once however many times it was uploaded.
• The uploads added up by site, by person, and by person and site, so the largest uploaders stand out.
• For the most-grown sites, how the space splits into current files, version history, the Preservation Hold Library, the recycle bin and the second-stage recycle bin.
• Whether version history is the largest part of a site, with a link to the Version history tools when it is.

How it runs

1. Sign in once. Reports › Storage growth. The tile asks which account to use and how to connect, and asks for every permission the report reads in that one sign-in. App authentication is recommended: who uploaded what comes from the audit log through Microsoft Graph, which User authentication cannot reach. On User authentication the options page says so before you run.
2. Choose how far back. Last 7, 30, 90 or 180 days; 30 is the default. The audit log is searched for this period.
3. Edits, if you want them. Also count files that were edited, not only new uploads. An edit adds a version, which also takes space. It is off by default because it can make the audit search much larger.
4. Choose how many sites to break down. None, or the top 3, 5, 10 or 25 sites; the top 5 is the default. Each one is read library by library, so a large site takes a few minutes.
5. Run report. The run screen shows each part as it goes. The audit search is run by Microsoft 365 and usually takes 5 to 30 minutes. Stop offers Finish, which ends the part in progress and keeps what was found, or Stop now.
6. Read the result. The Done screen gives the headline: how many sites grew and by how much, how many files were uploaded by how many people, and which sites were broken down. The workbook goes into History, and Save report keeps a copy where you choose.

How it works

The run has three parts and changes nothing. First it reads every site's storage. Where your sign-in allows it, that is one read of every site collection from the SharePoint admin centre; otherwise each site you can open is read on its own, a few at a time, and a site that cannot be read is noted and the run carries on. Each site is then given an earlier figure: this report's own last run for this tenant on this computer, or, when there is none, Microsoft's usage report for a day no more than 27 days back. The figures are saved for the next run, and the last 60 runs are kept. Microsoft's daily total for the whole tenant over the period is read as well.

Second, it asks Microsoft 365 to search the audit log for uploads in the period, and for edits too if you ticked that. The search is run by Microsoft and the report waits for it, showing how long it has been running. Each file is listed once, with how many audit events it had and the first and last of them. Its size is then looked up as it is now; when it cannot be, the size the audit record carried is used, and a file that is no longer there is marked as such. Names that the audit log writes in two forms for the same person are joined into one. The uploads are then added up by site, by person, and by person and site.

Third, it breaks down the most-grown sites, up to the number you chose; on a first run with no earlier figures, the sites with the most uploads, and failing that the largest. Each site is read library by library, with its Preservation Hold Library and both recycle bins. Version history is each library's total minus its current files. When SharePoint gives no total for a library, its current files are added up one by one, and the site's version history is worked out from the site total instead; the Status column says which. When version history is the largest part, the report says so and offers the Version history tools.

Without Microsoft Graph, which User authentication cannot reach, the audit search, Microsoft's usage report and the size lookups are skipped and the workbook says why. Finish lets the part in progress end and keeps everything found so far; Stop now ends at once, and an audit search already started carries on in Microsoft Purview. The workbook goes into History when the run ends.

What you get

An Excel workbook, named like Storage growth report 2026-11-11 16-15.xlsx, kept in Report History whether or not you save it. Sites is the first sheet to read; Uploads by person answers who. The About sheet names every source the run used and anything it left out.

Sites sheet

Every site's storage now, the earlier figure and the change, most grown first.

Uploads by site sheet

Files uploaded per site, their known size, and how many have been deleted or moved since.

Uploads by person sheet

The same, per person.

Uploads by person and site sheet

The same, per person on each site.

Uploaded files sheet

One row per file, newest first.

What the space is made of sheet

For the sites broken down: SharePoint's total split into current files, version history, the Preservation Hold Library and both recycle bins.

Tenant storage by day sheet

The tenant's SharePoint storage for each day of the period, from Microsoft's usage report.

What you need

• One sign-in to the tenant. App authentication or Cert authentication runs every part; User authentication runs which sites grew and what the space is made of, and skips who uploaded what.
• For who uploaded what: the AuditLogsQuery.Read.All permission, which an administrator approves once at this report's sign-in, and an account with an audit role (Global Administrator, Compliance Administrator, or an Audit Logs role in Microsoft Purview). On Cert authentication the app registration needs the SharePoint and OneDrive audit log query roles.
• The SharePoint administrator role for every site's figure in one read from the SharePoint admin centre. Without it, each site you can open is read on its own, and sites you cannot open are not in the report.

What it will not do

• The audit log reaches back 180 days at most, so that is the longest period on offer.
• The first run has no earlier figure of its own. Each run saves every site's storage on this computer, so the next run shows the real change. Until then the earlier figure comes from Microsoft's usage report, from no more than 27 days back, and only where Microsoft gives one.
• On a tenant that hides site names in Microsoft 365 usage reports, Microsoft's earlier figures cannot be matched to sites. The report says so.
• A file's size is its size now, looked up one by one for up to 20,000 files. Past that, or when the file cannot be opened, the size the audit record carried is used. A file that is no longer there, deleted or moved since it was uploaded, is marked Deleted since upload.
• Uploads explain new files. Growth from new versions of existing files shows only when edits are counted, and space freed by deletions is not subtracted from anyone's uploads.
• Uploads made by an app rather than a person are listed under the identity the audit log records for that app.
• When SharePoint will not total a library, its current files are counted one by one and the site's version history is calculated: the site total minus current files, the Preservation Hold Library and the recycle bins. The row's Status says so.
• If the audit search is still running after three hours, the report stops waiting. The search carries on in Microsoft Purview under the name ShareMaster storage growth.
• It changes nothing. Version Trim is offered only as a link.

Read next

• Site & subsite storage: Every site and subsite measured directly and ranked, when you need sizes rather than growth.
• Version trimming: Where to go when version history is the largest part of a site.
• Search the Preservation Hold Library: When the Preservation Hold Library is what grew: find out why each copy is still kept.
• History: Where every run of this report is kept.

See every feature