Forum Discussion
Solved
Microsoft Purview missing logs
I am trying to retrieve audit logs from Microsoft Purview that reflect SharePoint Online (SPO) list settings, specifically to identify who deleted certain columns. While I am able to obtain logs for actions such as PageViewed and SiteAccessed, I am having difficulty finding logs for List Column Deleted. The search results for this specific action return 0 results.
Try without scoping the results to a site also, just for the sake of testing. If you are not seeing anything, you'll have to work with support I'm afraid.
These activities are not captured in the audit section. >> go below part
- Login to the Microsoft Purview Portal
- on the left menu > select Activity explorer > modify the date and activity filters
- Select your desired activity and a fly-out menu will appear for any activities, audit acts at admin level, user activities will be handled at compliance portal activity explorer, check and update.
Thanks Vasil,
I conducted a search using the RecordType "SharePointListOperation" without scoping the results to a specific site, and it returned "Updated list" results across the entire site collection.
Similarly, a search using the activity "listcolumndeleted" without scoping the results to a specific site returned "Deleted list column" results across the site collection.
Could you please confirm if this is the correct method to retrieve SharePoint audit logs from Microsoft Purview? Alternatively, could this issue be related to the Microsoft Purview configuration?
There's nothing to configure, different event types expose different metadata/identifiers, so you might need some error/trial to find the correct approach, depending on the event. This is why I suggested to go with a broader search, not only you can confirm the events are captured, but see what identifier shows in there, so you know how to properly conduct a more targeted search. If you cannot find a better way to scope the search, you can use the -FreeText parameter as a last resort (but that's only exposed via the cmdlet).
Are you doing the search by specific operation(s)? Try doing it by RecordType ("SharePointListOperation"), just to make sure you are getting entries for this category.
Hi Vasil,
Thank you for your previous advice. Unfortunately, I tried your suggestions but still haven't had any success. Could you please provide further guidance or alternative solutions?
Try without scoping the results to a site also, just for the sake of testing. If you are not seeing anything, you'll have to work with support I'm afraid.
