Search the audit log in the Office 365 Security & Compliance Center - Audited Activities | File and folder activities

Created by Akshit Kapoor, Modified on Fri, 24 Feb, 2017 at 3:05 PM by Akshit Kapoor

The following table describes the file and folder activities in SharePoint Online and OneDrive for Business. The value in the Friendly name column is the activity name displayed in the Activities drop-down list on the Audit log search page and in the results. The value in the Operation column is the activity name from the Office 365 Management API schema.

Friendly name	Operation	Description
Accessed file	FileAccessed	User or system account accesses a file.
Checked in file	FileCheckedIn	User checks in a document that they checked out from a document library.
Checked out file	FileCheckedOut	User checks out a document located in a document library. Users can check out and make changes to documents that have been shared with them.
Copied file	FileCopied	User copies a document from a site. The copied file can be saved to another folder on the site.
Deleted file	FileDeleted	User deletes a document from a site.
Discarded file checkout	FileCheckOutDiscarded	User discards (or undos) a checked out file. That means any changes they made to the file when it was checked out are discarded, and not saved to the version of the document in the document library.
Downloaded file	FileDownloaded	User downloads a document from a site.
Modified file	FileModified	User or system account modifies the content or the properties of a document located on a site.
Moved file	FileMoved	User moves a document from its current location on a site to a new location.
Renamed file	FileRenamed	User renames a document on a site.
Restored file	FileRestored	User restores a document from the recycle bin of a site.
Uploaded file	FileUploaded	User uploads a document to a folder on a site.