Site administration activities that can be audited in Office365

Created by Akshit Kapoor, Modified on Tue, 9 Jul, 2019 at 10:58 AM by Shashank Gupta

The following table lists the events that result from site administration tasks in SharePoint Online.

Friendly name	Operation	Description
Added exempt user agent	ExemptUserAgentSet	Global administrator adds a user agent to the list of exempt user agents in the SharePoint admin center.
Added site collection admin	SiteCollectionAdminAdded	Site collection administrator or owner adds a person as a site collection administrator for a site. Site collection administrators have full control permissions for the site collection and all subsites.
Added user or group to SharePoint group	AddedToGroup	User added a member or guest to a SharePoint group. This might have been an intentional action or the result of another activity, such as a sharing event.
Allowed user to create groups	AllowGroupCreationSet	Site administrator or owner adds a permission level to a site that allows a user assigned that permission to create a group for that site.
Changed exempt user agents	CustomizeExemptUsers	Global administrator customized the list of exempt user agents in the SharePoint admin center. You can specify which user agents to exempt from receiving an entire web page to index. This means when a user agent you’ve specified as exempt encounters an InfoPath form, the form will be returned as an XML file, instead of an entire web page. This makes indexing InfoPath forms faster.
Changed a sharing policy	SharingPolicyChanged	An administrator changed a SharePoint sharing policy by using the Office 365 admin portal, SharePoint admin portal, or SharePoint Online Management Shell. Any change to the settings in the sharing policy in your organization will be logged. The policy that was changed is identified in the ModifiedProperty field property when you export the search results.
Created group	GroupAdded	Site administrator or owner creates a group for a site, or performs a task that results in a group being created. For example, the first time a user creates a link to share a file, a system group is added to the user's OneDrive for Business site. This event can also be a result of a user creating a link with edit permissions to a shared file.
Created Sent To connection	SendToConnectionAdded	Global administrator creates a new Send To connection on the Records management page in the SharePoint admin center. A Send To connection specifies settings for a document repository or a records center. When you create a Send To connection, a Content Organizer can submit documents to the specified location.
Created site collection	SiteCollectionCreated	Global administrator creates a new site collection in your SharePoint Online organization.
Deleted group	GroupRemoved	User deletes a group from a site.
Deleted Sent To connection	SendToConnectionRemoved	Global administrator deletes a Send To connection on the Records management page in the SharePoint admin center.
Enabled document preview	PreviewModeEnabledSet	Site administrator enables document preview for a site.
Enabled legacy workflow	LegacyWorkflowEnabledSet	Site administrator or owner adds the SharePoint 2013 Workflow Task content type to the site. Global administrators can also enable work flows for the entire organization in the SharePoint admin center.
Enabled Office on Demand	OfficeOnDemandSet	Site administrator enables Office on Demand, which lets users access the latest version of Office desktop applications. Office on Demand is enabled in the SharePoint admin center and requires an Office 365 subscription that includes full, installed Office applications.
Enabled RSS feeds	NewsFeedEnabledSet	Site administrator or owner enables RSS feeds for a site. Global administrators can enable RSS feeds for the entire organization in the SharePoint admin center.
Enabled result source for People Searches	PeopleResultsScopeSet	Site administrator creates or changes the result source for People Searches for a site.
Modified site permissions	SitePermissionsModified	Site administrator or owner (or system account) changes the permission level that are assigned to a group on a site. This activity is also logged if all permissions are removed from a group. NOTE: This operation has been deprecated in SharePoint Online. To find related events, you can search for other permission-related activities such as Added site collection admin, Added user or group to SharePoint group, Allowed user to create groups, Created group, and Deleted group.
Removed user or group from SharePoint group	RemovedFromGroup	User removed a member or guest from a SharePoint group. This might have been an intentional action or the result of another activity, such as an unsharing event.
Renamed site	SiteRenamed	Site administrator or owner renames a site
Requested site admin permissions	SiteAdminChangeRequest	User requests to be added as a site collection administrator for a site collection. Site collection administrators have full control permissions for the site collection and all subsites.
Set host site	HostSiteSet	Global administrator changes the designated site to host personal or OneDrive for Business sites.
Updated group	GroupUpdated	Site administrator or owner changes the settings of a group for a site. This can include changing the group's name, who can view or edit the group membership, and how membership requests are handled.

For any other concerns related to Office 365 plan and subscriptions. You can reach out to us by submitting a ticket on our portal https://cloud.foetron.com/ or you can directly mail us at [email protected]. Check out our website www.foetron.com to know about the services offered by us.