SharePoint Audit Log Retention: What Admins Need to Know

Retention period by licence tier - quick reference. Scroll down for event categories, access methods, and frequently asked questions.

What Is the Microsoft 365 Unified Audit Log?

The Unified Audit Log (UAL) is a centralised activity log shared across Microsoft 365 workloads including SharePoint Online, Exchange Online, Microsoft Teams, OneDrive for Business, and Entra ID. All SharePoint audit events are written to the UAL. Microsoft retired the classic SharePoint-specific audit reports that once lived under Site Settings, and the UAL is now the sole audit trail for SharePoint Online activity.

The UAL is hosted and managed by Microsoft. You cannot adjust the retention period through SharePoint or the Microsoft 365 admin centre; retention is governed by the Purview Audit (Standard or Premium) licence of each user who generates the event, plus any audit log retention policies created in the Microsoft Purview portal, which need Audit (Premium).

SharePoint Events Captured in the Audit Log

Standard events (all plans)

The following categories of SharePoint events are captured automatically at no additional cost on any Microsoft 365 plan:

Premium events (E5 / Purview Audit Premium only)

Microsoft Purview Audit (Premium) adds two event categories not available on standard plans:

Accessing and Exporting SharePoint Audit Logs

Microsoft Purview compliance portal

The recommended starting point for ad-hoc investigation. Navigate to purview.microsoft.com, select Audit, then filter by workload (SharePoint, SharePoint file and page activities, or SharePoint sharing and access request activities). Set a date range, optionally restrict to specific users or sites, and run the search. Export results to CSV directly from the portal.

Microsoft does not guarantee a time, but SharePoint and OneDrive records are typically searchable 60 to 90 minutes after the event; other services can take longer. One portal search covers up to 180 days, and a broad search in a large tenant can take hours to finish.

PowerShell

The Search-UnifiedAuditLog cmdlet in the Exchange Online Management module returns audit records programmatically. Commonly used parameters:

• -RecordType SharePoint: file, folder, and site events
• -RecordType SharePointSharingOperations: sharing and permission events
• -Operations FileDeleted,FileRecycled: filter to specific operations
• -UserIds user@contoso.com: restrict results to a single account
• -ResultSize 5000: maximum records per call; repeat the call with the same -SessionId and -SessionCommand ReturnLargeSet to page through up to 50,000 results

Microsoft Graph and Management Activity API

The Office 365 Management Activity API is designed for streaming high-volume audit events into a SIEM or data lake. The Microsoft Graph Audit Search API (POST /security/auditLog/queries) suits targeted queries in custom applications. Both need an app registration in Entra ID: the Management Activity API uses ActivityFeed.Read, and the Audit Search API uses AuditLogsQuery-SharePoint.Read.All or AuditLogsQuery.Read.All. The Graph /auditLogs endpoint is a different thing: the Entra ID directory and sign-in logs, not the unified audit log.

Frequently Asked Questions

How long are SharePoint audit logs kept by default?

SharePoint audit records are stored in the Microsoft 365 Unified Audit Log and kept for 180 days by default (records created before 17 October 2023 were kept for 90 days). For users with an E5 licence, or the Microsoft Purview Suite or E5 eDiscovery and Audit add-on, SharePoint, OneDrive, Exchange and Entra ID records are kept for one year. Keeping them for up to 10 years needs an audit log retention policy plus the 10-Year Audit Log Retention add-on licence for each user.

Does SharePoint Online have its own audit log?

No. SharePoint Online no longer has a standalone audit log interface. Microsoft retired the classic SharePoint audit reports and now routes all SharePoint events into the Microsoft 365 Unified Audit Log, searchable via the Microsoft Purview compliance portal.

How do I export SharePoint audit logs to CSV?

In the Microsoft Purview compliance portal, open Audit, set the date range and workload filter to SharePoint, run the search, then click Export. Results download as a CSV file. For scripted exports, use the Search-UnifiedAuditLog PowerShell cmdlet with the -RecordType SharePoint parameter.

For a broader reference on SharePoint Online operational limits, see the SharePoint Online limits reference. To audit the sharing links on a site, library by library, see how to audit SharePoint shared links.