The tenant storage figure jumps by hundreds of gigabytes in a month, and someone asks two questions: where did it go, and who put it there? The SharePoint admin centre tells you each site's size today. It does not tell you what each site was last month, who uploaded the new files, or whether the space is files at all rather than old versions or deleted items still being held.
Answering that by hand means three separate jobs, and joining their results yourself. ShareMaster's Storage growth report does all three in one read-only run.
Three questions, three sources
| Question | Where the answer lives | What makes it slow by hand |
|---|---|---|
| Which sites grew? | Each site's storage now, compared with an earlier figure | The admin centre shows today's figure only. You need last month's to compare against. |
| Who uploaded what? | The Microsoft 365 audit log, which records each upload with the person, the file and the time | A Purview audit search returns raw events. Turning them into totals per person and per site, with file sizes, is spreadsheet work. |
| What is the space made of? | Each library's storage, the Preservation Hold Library and the two recycle bins | Version history is not shown as its own number anywhere. It has to be worked out library by library. |
Run the Storage growth report
- Open Reports, then Storage growth, and sign in. The tile asks which account to use and how to connect, and asks for every permission the report reads in that one sign-in. Choose App authentication: the uploads come from the audit log through Microsoft Graph, which User authentication cannot reach. If you do sign in with User authentication, the options page says so before you run, and the report still answers which sites grew and what the space is made of.
- Choose how far back. The last 7, 30, 90 or 180 days. The default is 30. Pick a period that starts before the jump.
- Decide whether edits count. Also count files that were edited, not only new uploads is off by default, because it can make the audit search much larger. Tick it when people work on large files that already exist: every save adds a version, and versions take space too.
- Choose how many sites to break down. None, or the top 3, 5, 10 or 25 sites; the default is the top 5. Each one is read library by library, so a large site takes a few minutes.
- Select Run report. The run screen shows each part as it goes. The audit search is run by Microsoft 365 and usually takes 5 to 30 minutes. If you need to stop, Finish lets the current part end and keeps what was found; Stop now ends at once.
- Read the result. The Done screen gives the headline: how many sites grew and by how much, and how many files were uploaded by how many people. The workbook goes into History, and Save report keeps a copy where you choose.
What the workbook shows
| Sheet | What it answers |
|---|---|
| Sites | Every site's storage now, the earlier figure, the change, and where the earlier figure came from. Most grown first. |
| Uploads by site | Files uploaded to each site in the period, their known size, how many have been deleted or moved since, and how many audit events they had. |
| Uploads by person | The same, per person. This is usually the sheet that answers "who". |
| Uploads by person and site | The same, per person on each site. |
| Uploaded files | One row per file, newest first: who, which site, the file, its size and where the size came from. A file uploaded several times is listed once. |
| What the space is made of | For the sites broken down: SharePoint's total split into current files, version history, the Preservation Hold Library, the recycle bin and the second-stage recycle bin. |
| Tenant storage by day | The tenant's SharePoint storage for each day of the period, from Microsoft's usage report. |
| About | What the run read, from where, and anything it could not read. |
Where the earlier figure comes from
Every run saves each site's storage on the computer that ran it. The next run compares against that, so from the second run on, the change is exact. On the first run there is nothing of its own to compare with, so the report uses Microsoft's usage report for a day no more than 27 days back, where Microsoft has a figure for the site. Two cases leave a site without an earlier figure:
- The tenant hides site names in Microsoft 365 usage reports (Microsoft 365 admin centre, Settings, Org settings, Reports, Display concealed user, group, and site names). Microsoft's figures then cannot be matched to sites, and the report says so.
- You signed in with User authentication, which cannot read Microsoft's usage report.
Either way the run is a baseline. Run it again later and every site shows its change. If you expect to be asked this question again, run the report now and keep running it from the same computer.
When version history is the answer
Uploads explain new files. They do not explain a site that grew while nobody added anything, which is usually version history: every save of a file keeps another copy. The breakdown works out version history for each site as each library's total minus its current files. When SharePoint gives no total for a library, its current files are added up one by one and version history is worked out from the site total instead, and the Status column says which method was used.
When version history is the largest part of a site, the report says so and offers a link to the Version history tools. It never trims anything itself. If the Preservation Hold Library is the large part, Search the Preservation Hold Library shows why each copy is still kept.
What you need
- One sign-in to the tenant. App or Cert authentication runs every part of the report.
-
For the uploads: the
AuditLogsQuery.Read.Allpermission, which an administrator approves once at the report's sign-in, and an account with an audit role: Global Administrator, Compliance Administrator, or an Audit Logs role in Microsoft Purview. - The SharePoint administrator role to read every site in one go from the SharePoint admin centre. Without it, each site you can open is read on its own, and sites you cannot open are left out.
Frequently asked questions
Our SharePoint storage grew by about 500 GB. How do we find which sites grew and who uploaded it?
Run the Storage growth report for a period that starts before the jump. The Sites sheet ranks every site by its change. Uploads by person and Uploads by site add up the files the audit log records as uploaded, with their sizes, so the largest uploaders are at the top. What the space is made of then shows whether the grown sites hold new files, old versions, held copies or deleted items.
The uploads add up to less than the growth. Where is the rest?
Look at the breakdown sheet. Version history, the Preservation Hold Library and the recycle bins all count in a site's storage without being new uploads. Edits add versions rather than files, so run the report again with Also count files that were edited ticked to see who has been saving over large files. Space freed by deletions is not taken off anyone's uploads.
Some uploads show an app instead of a person. Why?
Files written by an app, such as a migration tool signed in as itself rather than as a person, are recorded in the audit log under that app's identity, and the report shows what the audit log recorded.
How far back can it look?
180 days at most, because that is as far back as the audit log the report searches reaches.
The audit search is taking a long time. Is something wrong?
Microsoft 365 runs the search, and the run screen shows how long it has been going. It usually takes 5 to 30 minutes. If it is still running after three hours the report stops waiting, and the search carries on in Microsoft Purview under the name ShareMaster storage growth.
Does the report change anything?
No. It only reads. Version Trim is offered as a link, and you decide there.
Which plans include it?
All of them, the free Community plan too. The full manual page is Storage growth in the documentation.
Last updated