The following table lists the events that result from site administration tasks in SharePoint Online.


Friendly name
Operation
Description
Added exempt user agent
ExemptUserAgentSet
Global administrator adds a user agent to the list of exempt user agents in the SharePoint admin center.
Added site collection admin
SiteCollectionAdminAdded
Site collection administrator or owner adds a person as a site collection administrator for a site. Site collection administrators have full control permissions for the site collection and all subsites.
Added user or group to SharePoint group
AddedToGroup
User added a member or guest to a SharePoint group. This might have been an intentional action or the result of another activity, such as a sharing event.
Allowed user to create groups
AllowGroupCreationSet
Site administrator or owner adds a permission level to a site that allows a user assigned that permission to create a group for that site.
Changed exempt user agents
CustomizeExemptUsers
Global administrator customized the list of exempt user agents in the SharePoint admin center. You can specify which user agents to exempt from receiving an entire web page to index. This means when a user agent you’ve specified as exempt encounters an InfoPath form, the form will be returned as an XML file, instead of an entire web page. This makes indexing InfoPath forms faster.
Changed a sharing policy
SharingPolicyChanged
An administrator changed a SharePoint sharing policy by using the Office 365 admin portal, SharePoint admin portal, or SharePoint Online Management Shell. Any change to the settings in the sharing policy in your organization will be logged. The policy that was changed is identified in the ModifiedProperty field property when you export the search results.
Created group
GroupAdded
Site administrator or owner creates a group for a site, or performs a task that results in a group being created. For example, the first time a user creates a link to share a file, a system group is added to the user's OneDrive for Business site. This event can also be a result of a user creating a link with edit permissions to a shared file.
Created Sent To connection
SendToConnectionAdded
Global administrator creates a new Send To connection on the Records management page in the SharePoint admin center. A Send To connection specifies settings for a document repository or a records center. When you create a Send To connection, a Content Organizer can submit documents to the specified location.
Created site collection
SiteCollectionCreated
Global administrator creates a new site collection in your SharePoint Online organization.
Deleted group
GroupRemoved
User deletes a group from a site.
Deleted Sent To connection
SendToConnectionRemoved
Global administrator deletes a Send To connection on the Records management page in the SharePoint admin center.
Enabled document preview
PreviewModeEnabledSet
Site administrator enables document preview for a site.
Enabled legacy workflow
LegacyWorkflowEnabledSet
Site administrator or owner adds the SharePoint 2013 Workflow Task content type to the site. Global administrators can also enable work flows for the entire organization in the SharePoint admin center.
Enabled Office on Demand
OfficeOnDemandSet
Site administrator enables Office on Demand, which lets users access the latest version of Office desktop applications. Office on Demand is enabled in the SharePoint admin center and requires an Office 365 subscription that includes full, installed Office applications.
Enabled RSS feeds
NewsFeedEnabledSet
Site administrator or owner enables RSS feeds for a site. Global administrators can enable RSS feeds for the entire organization in the SharePoint admin center.
Enabled result source for People Searches
PeopleResultsScopeSet
Site administrator creates or changes the result source for People Searches for a site.
Modified site permissions
SitePermissionsModified
Site administrator or owner (or system account) changes the permission level that are assigned to a group on a site. This activity is also logged if all permissions are removed from a group.
NOTE: This operation has been deprecated in SharePoint Online. To find related events, you can search for other permission-related activities such as Added site collection admin, Added user or group to SharePoint group, Allowed user to create groups, Created group, and Deleted group.
Removed user or group from SharePoint group
RemovedFromGroup
User removed a member or guest from a SharePoint group. This might have been an intentional action or the result of another activity, such as an unsharing event.
Renamed site
SiteRenamed
Site administrator or owner renames a site
Requested site admin permissions
SiteAdminChangeRequest
User requests to be added as a site collection administrator for a site collection. Site collection administrators have full control permissions for the site collection and all subsites.
Set host site
HostSiteSet
Global administrator changes the designated site to host personal or OneDrive for Business sites.
Updated group
GroupUpdated
Site administrator or owner changes the settings of a group for a site. This can include changing the group's name, who can view or edit the group membership, and how membership requests are handled.