Microsoft Office 365 OneDrive for Business Audit Events
The following list of audit events are supported for Microsoft Office 365 OneDrive for Business. For event description, refer to the Microsoft article.
Event Name |
|---|
AccessInvitationAccepted |
AccessInvitationCreated |
AccessInvitationExpired |
AccessInvitationRevoked |
AccessInvitationUpdated |
AccessRequestAccepted |
AccessRequestApproved |
AccessRequestCreated |
AccessRequestDenied |
AccessRequestExpired |
AccessRequestRejected |
ActivationEnabled |
Add app role assignment grant to user |
Add app role assignment to group |
Add application |
Add delegation entry |
Add device |
Add domain to company |
Add external user to group. |
Add group |
Add member to group |
Add member to role |
Add OAuth2PermissionGrant |
Add owner to application |
Add owner to group |
Add owner to service principal |
Add partner to company |
Add policy |
Add policy to service principal |
Add registered owner to device |
Add registered users to device |
Add role member to Role |
Add service principal |
Add service principal credentials |
Add unverified domain |
Add user |
AddedToGroup |
AddedToSecureLink |
AdministratorAddedToTermStore |
AdministratorDeletedFromTermStore |
AllowGroupCreationSet |
AnonymousLinkCreated |
AnonymousLinkRemoved |
AnonymousLinkUpdated |
AnonymousLinkUsed |
AppCatalogCreated |
Assign external user to application. |
AuditPolicyRemoved |
AuditPolicyUpdate |
AzureStreamingEnabledSet |
Batch invites processed. |
Batch invites uploaded. |
Change user license |
Change user password |
ChannelAdded |
ChannelDeleted |
CollaborationTypeModified |
CompanyLinkCreated |
CompanyLinkRemoved |
CompanyLinkUsed |
Consent to application |
Create application password for user |
Create company |
CreateSSOApplication |
CustomizeExemptUsers |
DefaultLanguageChangedInTermStore |
Delete device |
Delete group |
Delete user |
DeleteSSOApplication |
DisableSharingForNonOwners |
eDiscoveryHoldApplied |
eDiscoveryHoldRemoved |
eDiscoverySearchPerformed |
ExemptUserAgentSet |
Failed Login |
FileAccessed |
FileCheckedIn |
FileCheckedOut |
FileCheckOutDiscarded |
FileCopied |
FileDeleted |
FileDeletedFirstStageRecycleBin |
FileDownloaded |
FileFetched |
FileModified |
FileMoved |
FilePreviewed |
FileRenamed |
FileRestored |
FileSyncDownloadedFull |
FileSyncDownloadedPartial |
FileSyncUploadedFull |
FileSyncUploadedPartial |
FileUploaded |
FileViewed |
Finish applying group based license to users |
FolderCreated |
FolderDeleted |
FolderDeletedFirstStageRecycleBin |
FolderModified |
FolderMoved |
FolderRenamed |
FolderRestored |
ForeignRealmIndexLogonCookieCopyUsingDAToken |
ForeignRealmIndexLogonInitialAuthUsingADFSFederatedToken |
GroupAdded |
GroupRemoved |
GroupUpdated |
Invite external user. |
LanguageAddedToTermStore |
LanguageRemovedFromTermStore |
LegacyWorkflowEnabledSet |
Login |
MaxQuotaModified |
MaxResourceUsageModified |
MemberAdded |
MemberRemoved |
MySitePublicEnabledSet |
NewsFeedEnabledSet |
ODBNextUXSettings |
OfficeOnDemandSet |
PageViewed |
PasswordLogonCookieCopyUsingDAToken |
PasswordLogonInitialAuthUsingADFSFederatedToken |
PasswordLogonInitialAuthUsingPassword |
PeopleResultsScopeSet |
PreviewModeEnabledSet |
QuotaWarningEnabledModified |
Redeem external user invite. |
Remove app role assignment from user |
Remove delegation entry |
Remove domain from company |
Remove eligible member from role |
Remove member from group |
Remove member from role |
Remove OAuth2PermissionGrant |
Remove owner from group |
Remove Partner from company |
Remove policy credentials |
Remove role member from Role |
Remove service principal |
Remove service principal credentials |
RemovedFromGroup |
RemovedFromSharedWithMe |
RemovedFromSiteCollection |
RenderingEnabled |
Reset user password |
ResourceWarningEnabledModified |
Restore user |
Revoke consent |
SearchCenterUrlSet |
SecondaryMySiteOwnerSet |
SecureLinkCreated |
SecureLinkUsed |
SendToConnectionAdded |
SendToConnectionRemoved |
Set Company contact information |
Set Company Information |
Set delegation entry |
Set DirSyncEnabled flag on company |
Set domain authentication |
Set federation settings on domain |
Set force change user password |
Set group license |
Set license properties |
Set Password Policy |
SharedLinkCreated |
SharedLinkDisabled |
SharingInheritanceBroken |
SharingInvitationAccepted |
SharingInvitationCreated |
SharingInvitationRevoked |
SharingPolicyChanged |
SharingRevoked |
SharingSet |
SiteAdminChangeRequest |
SiteCollectionAdminAdded |
SiteCollectionAdminRemoved |
SiteCollectionCreated |
SitePermissionsModified |
SiteRenamed |
SSOGroupCredentialsSet |
SSOUserCredentialsSet |
Start applying group based license to users |
SyncGetChanges |
TeamCreated |
TeamDeleted |
TeamSettingChanged |
Trigger group license recalculation |
UnmanagedSyncClientBlocked |
Update application |
Update device |
Update domain |
Update external secrets |
Update group |
Update policy |
Update service principal |
Update user |
UpdateSSOApplication |
UserAddedToGroup |
UserLoggedIn |
UserLoginFailed |
UserRemovedFromGroup |
Verify domain |
Verify email verified domain |
VideoRequested |
Viral tenant creation. |
Viral user creation. |
WACTokenShared |