SharePoint Audit Log Visualizer Guide
How to export and visualize your SharePoint audit logs
This tool visualizes SharePoint audit log data exported from Microsoft Purview. It helps you analyze user activity, track document changes, sharing events, and identify potential security concerns in your SharePoint environment.
- 1
Access Microsoft Purview
Go to the Microsoft Purview compliance portal (compliance.microsoft.com) and sign in with your admin account.
- 2
Navigate to Audit
In the left navigation, click on "Solutions" then "Audit" to access the audit log search.
- 3
Configure Search
Set your date range and select "SharePoint" activities. You can also filter by specific users or sites.
- 4
Export Results
Click "Export" and choose to download all results. The file will be downloaded as a CSV.
- 5
Upload to Tool
Upload the exported CSV or JSON file to this tool for visualization and analysis.
The exported file from Microsoft Purview will typically be in CSV format. JSON exports are also supported if you've converted the data.
Download example files to test the tool
See what the file formats look like
Schema
Timestamp,User,Operation,FileName,FileExtension,SiteUrl,SourceRelativeUrl,ClientIP,UserAgent
2025-12-23T09:15:23Z,john.smith@example.com,FileAccessed,Q4_Report.docx,docx,https://example.sharepoint.com/sites/marketing,Shared Documents,192.168.1.45,Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0Preview
| Timestamp | User | Operation | FileName | FileExtension | SiteUrl | ClientIP |
|---|---|---|---|---|---|---|
| 2025-12-23T09:15:23Z | john.smith@example.com | FileAccessed | Q4_Report.docx | docx | ...sharepoint.com/sites/marketing | 192.168.1.45 |
{
"Id": "d6e7f8a9-b0c1-2345-6f82-123456789012",
"RecordType": 6,
"CreationTime": "2026-01-05T18:20:00Z",
"Operation": "FileUploaded",
"OrganizationId": "12345678-abcd-efgh-ijkl-9876543210ab",
"UserType": 0,
"UserKey": "mike.wilson@example.com",
"Workload": "SharePoint",
"ResultStatus": "Succeeded",
"ObjectId": "https://example.sharepoint.com/sites/engineering/Shared Documents/Release_Package.zip",
"UserId": "mike.wilson@example.com",
"ClientIP": "192.168.2.100",
"Site": "jkl90123-mno4-5678-uvwx-yz0123456789",
"ItemType": 1,
"EventSource": 0,
"SourceName": "SharePoint",
"UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0",
"SiteUrl": "https://example.sharepoint.com/sites/engineering",
"SourceRelativeUrl": "Shared Documents",
"SourceFileName": "Release_Package.zip",
"SourceFileExtension": "zip"
}