The following table lists the events that result from site administration tasks in SharePoint Online.
|Added exempt user agent
||Global administrator adds a user agent to the list of exempt user agents in the SharePoint admin center.
|Added site collection admin
||Site collection administrator or owner adds a person as a site collection administrator for a site. Site collection administrators have full control permissions for the site collection and all subsites.
|Added user or group to SharePoint group
||User added a member or guest to a SharePoint group. This might have been an intentional action or the result of another activity, such as a sharing event.
|Allowed user to create groups
||Site administrator or owner adds a permission level to a site that allows a user assigned that permission to create a group for that site.
|Changed exempt user agents
||Global administrator customized the list of exempt user agents in the SharePoint admin center. You can specify which user agents to exempt from receiving an entire web page to index. This means when a user agent you’ve specified as exempt encounters an InfoPath form, the form will be returned as an XML file, instead of an entire web page. This makes indexing InfoPath forms faster.
|Changed a sharing policy
||An administrator changed a SharePoint sharing policy by using the Office 365 admin portal, SharePoint admin portal, or SharePoint Online Management Shell. Any change to the settings in the sharing policy in your organization will be logged. The policy that was changed is identified in the ModifiedProperty field property when you export the search results.
||Site administrator or owner creates a group for a site, or performs a task that results in a group being created. For example, the first time a user creates a link to share a file, a system group is added to the user's OneDrive for Business site. This event can also be a result of a user creating a link with edit permissions to a shared file.
|Created Sent To connection
||Global administrator creates a new Send To connection on the Records management page in the SharePoint admin center. A Send To connection specifies settings for a document repository or a records center. When you create a Send To connection, a Content Organizer can submit documents to the specified location.
|Created site collection
||Global administrator creates a new site collection in your SharePoint Online organization.
||User deletes a group from a site.
|Deleted Sent To connection
||Global administrator deletes a Send To connection on the Records management page in the SharePoint admin center.
|Enabled document preview
||Site administrator enables document preview for a site.
|Enabled legacy workflow
||Site administrator or owner adds the SharePoint 2013 Workflow Task content type to the site. Global administrators can also enable work flows for the entire organization in the SharePoint admin center.
|Enabled Office on Demand
||Site administrator enables Office on Demand, which lets users access the latest version of Office desktop applications. Office on Demand is enabled in the SharePoint admin center and requires an Office 365 subscription that includes full, installed Office applications.
|Enabled RSS feeds
||Site administrator or owner enables RSS feeds for a site. Global administrators can enable RSS feeds for the entire organization in the SharePoint admin center.
|Enabled result source for People Searches
||Site administrator creates or changes the result source for People Searches for a site.
|Modified site permissions
||Site administrator or owner (or system account) changes the permission level that are assigned to a group on a site. This activity is also logged if all permissions are removed from a group.
NOTE: This operation has been deprecated in SharePoint Online. To find related events, you can search for other permission-related activities such as Added site collection admin, Added user or group to SharePoint group, Allowed user to create groups, Created group, and Deleted group.
|Removed user or group from SharePoint group
||User removed a member or guest from a SharePoint group. This might have been an intentional action or the result of another activity, such as an unsharing event.
||Site administrator or owner renames a site
|Requested site admin permissions
||User requests to be added as a site collection administrator for a site collection. Site collection administrators have full control permissions for the site collection and all subsites.
|Set host site
||Global administrator changes the designated site to host personal or OneDrive for Business sites.
||Site administrator or owner changes the settings of a group for a site. This can include changing the group's name, who can view or edit the group membership, and how membership requests are handled.