The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Use Microsoft Purview Audit to investigate SharePoint activity, or collect audit events through the Office 365 Management Activity API for ongoing monitoring. First confirm audit ingestion is enabled and that your account has permission to search. Then investigate unusual sharing, permission and administrator changes, site configuration, and deletion activity in context. Audit records are delayed and retention depends on licensing and policy, so Purview search alone is not real-time detection.
Confirm SharePoint audit logging is enabled
Do not assume a tenant is recording events just because audit search is available. Microsoft says auditing is on by default for many Microsoft 365 organizations, but not for Business Basic, Business Standard, or Business Premium, or unmanaged tenants using free enterprise trials. Check the ingestion setting in Exchange Online PowerShell:
As an Amazon Associate I earn from qualifying purchases.
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabledTrue indicates that audit ingestion is enabled. Run the check in Exchange Online PowerShell: Microsoft warns that the same property queried in Security & Compliance PowerShell can return False even when audit log search is enabled. If auditing is disabled, enable it in Purview or run:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $trueMicrosoft says enabling auditing can take up to 60 minutes to take effect. See Microsoft’s instructions for turning auditing on or off.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Search the unified audit log
In the Microsoft Purview portal, open the Audit solution. Set a UTC time range and narrow the search with available filters such as user, activity or operation, record type, and administrative unit. Audit Logs or View-Only Audit Logs roles are required to search. The underlying PowerShell alternative is Search-UnifiedAuditLog, which runs in Exchange Online PowerShell.
- Choose the smallest time range that covers the activity you are investigating.
- Filter by the person or account, relevant SharePoint operations, or other available criteria.
- Review individual records and their details; export the results if you need to sort, compare, or preserve them for review.
A portal search supports a maximum 180-day date range. Exact operation names matter: a misspelled name returns no results. Microsoft’s guidance on filters, roles, and search is in Search the audit log.
Prioritize SharePoint events that merit review
Microsoft’s activity catalog includes many SharePoint events, but it does not label a universal set of them as suspicious. Treat an event as a lead, then assess who performed it, when and where it occurred, what access or change resulted, and whether it fits the person’s role and normal work.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Sharing and access requests
Review unexpected guest or external sharing, invitations, link activity, and access requests. Sharing-result details can identify who received access and whether the recipient is an organizational member or a guest. Consider the recipient, permissions granted, and sensitivity of the site or content.
Site permissions and administrator changes
Look for changes such as SiteCollectionAdminAdded, SiteCollectionAdminRemoved, AddedToGroup, RemovedFromGroup, permission inheritance changes, permission-level changes, and group updates. An unfamiliar administrator or permission change may deserve prompt review, but legitimate administration can produce the same events.
Site administration and configuration
Review events such as SharingPolicyChanged, network-access policy changes, and site creation, deletion, or restoration. A change to an organization-wide sharing policy may have broader consequences than an individual sharing action; compare it with approved change activity.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Lists and list items
Relevant operations include ListItemCreated, ListItemUpdated, ListItemDeleted, and ListItemRecycled, as well as list configuration changes. A concentration of deletion or recycle activity outside expected work is a reason to investigate, not proof of malicious activity.
Check Microsoft’s audit log activities catalog for operation names and what each records. Some SharePoint records show app@sharepoint as the actor on behalf of the initiating user or admin; inspect the record details before attributing the action.
Investigate an alert or unusual event
For a first review, prioritize unexpected guest sharing, unplanned administrator or permission changes, unusual concentrations of deletion or recycle events, and sharing-policy changes. These are practical review conditions based on the available event types, not verified malicious indicators or a Microsoft-prescribed alert rule.
Rank #4
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
- BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
- CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
- DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
- SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty
- Identify the actor, target site or item, event time, and any external recipient or permissions granted.
- Compare the action with the user’s role, the site’s sensitivity, normal activity, and approved business or administrative work.
- Correlate audit evidence with relevant identity, endpoint, security-alert, and business context before deciding an account or document was compromised.
- Preserve relevant exports under your organization’s incident-response and legal processes.
Account for search delays
Microsoft says core-service records, including SharePoint, are typically available 60–90 minutes after an event, but it does not guarantee a specific return time. Broad searches in large tenants can take up to 48 hours to complete. As Microsoft puts it, “Microsoft doesn’t guarantee a specific time after an event occurs for the corresponding audit record to be returned in the results of an audit log search.”
That makes audit search useful for investigation, but unsuitable as a promise of immediate detection. If you need ongoing collection and alerting, use a monitoring pipeline and account for the same event-arrival delays.
Recommended Free Tools
Choose between manual searches and ongoing collection
| Approach | Best fit | Trade-offs |
|---|---|---|
Purview Audit portal or Search-UnifiedAuditLog |
Ad hoc investigation, checking a user or incident, and exporting search results. | Human-directed searches require the appropriate role and fit within search constraints. Results are delayed, not guaranteed in real time. |
| Office 365 Management Activity API with a monitoring platform | Ongoing audit-data collection, alerting, correlation, and an organization-controlled monitoring pipeline. | Requires implementation and operational monitoring. Audit ingestion must remain enabled, and event arrival still has service delays. |
Microsoft documents the Office 365 Management Activity API as a programmatic way to download audit data for monitoring solutions. Microsoft also says the API and Sentinel cannot access audit data when auditing is disabled; see audit enablement guidance. The documentation does not establish a universal alert threshold or guarantee real-time detection.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Set retention to match your investigation window
Retention is not uniform across every user or record. Microsoft’s current guidance describes 180 days as the standard default for qualifying audit records. Older records generated before October 17, 2023 may retain the earlier 90-day period.
Audit Premium’s default one-year SharePoint retention applies to activity by users with qualifying licenses. Non-E5 users and guests may remain at 180 days. Ten-year retention requires an additional per-user add-on as well as qualifying licensing. Custom policies can change expiration, so check the user’s license and applicable policy before relying on a particular lookback period. See Microsoft’s audit log retention policy guidance and overview of auditing solutions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
