Enum SharePointAuditOperation

SharePointAuditOperation enumeration

SharePoint audit operations

public enum SharePointAuditOperation

Values

NameValueDescription
AccessInvitationAccepted0This operation is in Preview. The recipient of an invitation to view or edit a shared file (or folder) has accessed the shared file by clicking on the link in the invitation.
AccessInvitationCreated1This operation is in Preview. User sends an invitation to another person (inside or outside their organization) to view or edit a shared file or folder on a SharePoint or OneDrive for Business site. The details of the event entry identifies the name of the file that was shared, the user the invitation was sent to, and the type of the sharing permission selected by the person who sent the invitation.
AccessInvitationExpired2This operation is in Preview. An invitation sent to an external user expires. By default, an invitation sent to a user outside of your organization expires after 7 days if the invitation isn’t accepted.
AccessInvitationRevoked3This operation is in Preview. The site administrator or owner of a site or document in SharePoint or OneDrive for Business withdraws an invitation that was sent to a user outside your organization. An invitation can be withdrawn only before it’s accepted.
AccessInvitationUpdated4This operation is in Preview. The user who created and sent an invitation to another person to view or edit a shared file (or folder) on a SharePoint or OneDrive for Business site resends the invitation.
AccessRequestApproved5The site administrator or owner of a site or document in SharePoint or OneDrive for Business approves a user request to access the site or document.
AccessRequestCreated6User requests access to a site or document in SharePoint or OneDrive for Business that they don’t have permission to access.
AccessRequestRejected7This operation is in Preview. The site administrator or owner of a site or document in SharePoint declines a user request to access the site or document.
ActivationEnabled8This operation is in Preview. Users can browser-enable form templates that don’t contain form code, require full trust, enable rendering on a mobile device, or use a data connection managed by a server administrator.
AdministratorAddedToTermStore9This operation is in Preview. Term store administrator added.
AdministratorDeletedFromTermStore10This operation is in Preview. Term store administrator deleted.
AllowGroupCreationSet11This operation is in Preview. Site administrator or owner adds a permission level to a SharePoint or OneDrive for Business site that allows a user assigned that permission to create a group for that site.
AppCatalogCreated12This operation is in Preview. App catalog created to make custom business apps available for your SharePoint Environment.
AuditPolicyRemoved13This operation is in Preview. Document LifeCycle Policy has been removed for a site collection.
AuditPolicyUpdate14This operation is in Preview. Document LifeCycle Policy has been updated for a site collection.
AzureStreamingEnabledSet15This operation is in Preview. A video portal owner has allowed video streaming from Azure.
CollaborationTypeModified16This operation is in Preview. The type of collaboration allowed on sites (for example, intranet, extranet, or public) has been modified.
ConnectedSiteSettingModified17User has either created, modified or deleted the link between a project and a project site or the user modifies the synchronization setting on the link in Project Web App.
CreateSSOApplication18This operation is in Preview. Target application created in Secure store service.
CustomFieldOrLookupTableCreated19User created a custom frield or lookup table/item in Project Web App.
CustomFieldOrLookupTableDeleted20User deleted a custom field or lookup table/item in Project Web App.
CustomFieldOrLookupTableModified21User modified a custom field or lookup table/item in Project Web App.
CustomizeExemptUsers22This operation is in Preview. Global administrator customized the list of exempt user agents in SharePoint admin center. You can specify which user agents to exempt from receiving an entire Web page to index. This means when a user agent you’ve specified as exempt encounters an InfoPath form, the form will be returned as an XML file instead of an entire Web page. This makes indexing InfoPath forms faster.
DefaultLanguageChangedInTermStore23This operation is in Preview. Language setting changed in the terminology store.
DelegateModified24User created or modified a security delegate in Project Web App.
DelegateRemoved25User deleted a security delegate in Project Web App.
DeleteSSOApplication26This operation is in Preview. An SSO application was deleted.
eDiscoveryHoldApplied27This operation is in Preview. An In-Place Hold was placed on a content source. In-Place Holds are managed by using an eDiscovery site collection (such as the eDiscovery Center) in SharePoint.
eDiscoveryHoldRemoved28This operation is in Preview. An In-Place Hold was removed from a content source. In-Place Holds are managed by using an eDiscovery site collection (such as the eDiscovery Center) in SharePoint.
eDiscoverySearchPerformed29This operation is in Preview. An eDiscovery search was performed using an eDiscovery site collection in SharePoint.
EngagementAccepted30User accepts a resource engagement in Project Web App.
EngagementModified31User modifies a resource engagement in Project Web App.
EngagementRejected32User rejects a resource engagement in Project Web App.
EnterpriseCalendarModified33User copies, modifies or delete an enterprise calendar in Project Web App.
EntityDeleted34User deletes a timesheet in Project Web App.
EntityForceCheckedIn35User forces a checkin on a calendar, custom field or lookup table in Project Web App.
ExemptUserAgentSet36This operation is in Preview. Global administrator adds a user agent to the list of exempt user agents in the SharePoint admin center.
FileAccessed37User or system account accesses a file on a SharePoint or OneDrive for Business site. System accounts can also generate FileAccessed events.
FileCheckOutDiscarded38This operation is in Preview. User discards (or undos) a checked out file. That means any changes they made to the file when it was checked out are discarded, and not saved to the version of the document in the document library.
FileCheckedIn39This operation is in Preview. User checks in a document that they checked out from a SharePoint or OneDrive for Business document library.
FileCheckedOut40This operation is in Preview. User checks out a document located in a SharePoint or OneDrive for Business document library. Users can check out and make changes to documents that have been shared with them.
FileCopied41User copies a document from a SharePoint or OneDrive for Business site. The copied file can be saved to another folder on the site.
FileDeleted42User deletes a document from a SharePoint or OneDrive for Business site.
FileDeletedFirstStageRecycleBin43User deletes a file from the recycle bin on a SharePoint or OneDrive for Business site.
FileDeletedSecondStageRecycleBin44User deletes a file from the second-stage recycle bin on a SharePoint or OneDrive for Business site.
FileDownloaded45User downloads a document from a SharePoint or OneDrive for Business site.
FileFetched46This event has been replaced by the FileAccessed event, and has been deprecated.
FileModified47User or system account modifies the content or the properties of a document located on a SharePoint or OneDrive for Business site.
FileMoved48User moves a document from its current location on a SharePoint or OneDrive for Business site to a new location.
FilePreviewed49User previews a document on a SharePoint or OneDrive for Business site.
FileRenamed50User renames a document on a SharePoint or OneDrive for Business site.
FileRestored51User restores a document from the recycle bin of a SharePoint or OneDrive for Business site.
FileSyncDownloadedFull52User establishes a sync relationship and successfully downloads files for the first time to their computer from a SharePoint or OneDrive for Business document library.
FileSyncDownloadedPartial53User successfully downloads any changes to files from SharePoint or OneDrive for Business document library. This event indicates that any changes that were made to files in the document library were downloaded to the user’s computer. Only changes were downloaded because the document library was previously downloaded by the user (as indicated by the FileSyncDownloadedFull event).
FileSyncUploadedFull54This operation is in Preview. User establishes a sync relationship and successfully uploads files for the first time from their computer to a SharePoint or OneDrive for Business document library.
FileSyncUploadedPartial55This operation is in Preview. User successfully uploads changes to files on a SharePoint or OneDrive for Business document library. This event indicates that any changes made to the local version of a file from a document library are successfully uploaded to the document library. Only changes are unloaded because those files were previously uploaded by the user (as indicated by the FileSyncUploadedFull event).
FileUploaded56User uploads a document to a folder on a SharePoint or OneDrive for Business site.
FileViewed57This event has been replaced by the FileAccessed event, and has been deprecated.
FolderCopied58User copies a folder from a SharePoint or OneDrive for Business site to another location in SharePoint or OneDrive for Business.
FolderCreated59User creates a folder on a SharePoint or OneDrive for Business site.
FolderDeleted60User deletes a folder from a SharePoint or OneDrive for Business site.
FolderDeletedFirstStageRecycleBin61User deletes a folder from the recycle bin on a SharePoint or OneDrive for Business site .
FolderDeletedSecondStageRecycleBin62User deletes a folder from the second-stage recycle bin on a SharePoint or OneDrive for Business site.
FolderModified63User modifies a folder on a SharePoint or OneDrive for Business site. This event includes folder metadata changes, such as tags and properties.
FolderMoved64User moves a folder from a SharePoint or OneDrive for Business site.
FolderRenamed65User renames a folder on a SharePoint or OneDrive for Business site.
FolderRestored66User restores a folder from the Recycle Bin on a SharePoint or OneDrive for Business site.
GroupAdded67This operation is in Preview. Site administrator or owner creates a group for a SharePoint or OneDrive for Business site, or performs a task that results in a group being created. For example, the first time a user creates a link to share a file, a system group is added to the user’s OneDrive for Business site. This event can also be a result of a user creating a link with edit permissions to a shared file.
GroupRemoved68This operation is in Preview. User deletes a group from a SharePoint or OneDrive for Business site.
GroupUpdated69This operation is in Preview. Site administrator or owner changes the settings of a group for a SharePoint or OneDrive for Business site. This can include changing the group’s name, who can view or edit the group membership, and how membership requests are handled.
LanguageAddedToTermStore70This operation is in Preview. Language added to the terminology store.
LanguageRemovedFromTermStore71This operation is in Preview. Language removed from the terminology store.
LegacyWorkflowEnabledSet72This operation is in Preview. Site administrator or owner adds theSharePoint Workflow Task content type to the site. Global administrators can also enable work flows for the entire organization in theSharePoint admin center.
LookAndFeelModified73User modifies a quick launch, gantt chart formats, or group formats. Or the user creats, modifies, or deletes a view in Project Web App.
ManagedSyncClientAllowed74User successfully establishes a sync relationship with a SharePoint or OneDrive for Business site. The sync relationship is successful because the user’s computer is a member of a domain that’s been added to the list of domains (called the safe recipients list) that can access document libraries in your organization. For more information about this feature, see Use Windows PowerShell cmdlets to enable OneDrive sync for domains that are on the safe recipients list.
MaxQuotaModified75This operation is in Preview. The maximum quota for a site has been modified.
MaxResourceUsageModified76This operation is in Preview. The maximum allowable resource usage for a site has been modified.
MySitePublicEnabledSet77This operation is in Preview. The flag enabling users to have public MySites has been set by the SharePoint administrator.
NewsFeedEnabledSet78This operation is in Preview. Site administrator or owner enables RSS feeds for a SharePoint or OneDrive for Business site. Global administrators can enable RSS feeds for the entire organization in the SharePoint admin center.
ODBNextUXSettings79This operation is in Preview. New UI for OneDrive for Business has been enabled.
OfficeOnDemandSet80This operation is in Preview. Site administrator enables Office on Demand, which lets users access the latest version of Office desktop applications. Office on Demand is enabled in the SharePoint admin center and requires an Office 365 subscription that includes full, installed Office applications.
PageViewed81User views a page on a SharePoint site or OneDrive for Business site. This does not include viewing document library files from a SharePoint site or One Drive for Business site on a browser.
PeopleResultsScopeSet82This operation is in Preview. Site administrator creates or changes the result source for People Searches for a SharePoint site.
PermissionSyncSettingModified83User modifies the project permission sync settings in Project Web App.
PermissionTemplateModified84User creates, modifies or deletes a permissions template in Project Web App.
PortfolioDataAccessed85User accesses portfolio content (driver library, driver priortization, portfolio analyses) in Project Web App.
PortfolioDataModified86User creates, modifies, or deletes portfolio data (driver library, driver priortization, portfolio analyses) in Project Web App.
PreviewModeEnabledSet87This operation is in Preview. Site administrator enables document preview for a SharePoint site.
ProjectAccessed88User accesses project content in Project Web App.
ProjectCheckedIn89User checks in a project that they checked out from a Project Web App.
ProjectCheckedOut90User checks out a project located in a Project Web App. Users can check out and make changes to projects that they have permission to open.
ProjectCreated91User creates a project in Project Web App.
ProjectDeleted92User deletes a project in Project Web App.
ProjectForceCheckedIn93User forces a check in on a project in Project Web App.
ProjectModified94User modifies a project in Project Web App.
ProjectPublished95User publishes a project in Project Web App.
ProjectWorkflowRestarted96User restarts a workflow in Project Web App.
PWASettingsAccessed97User access the Project Web App settings via CSOM.
PWASettingsModified98User modifies the a Project Web App configuration.
QueueJobStateModified99User cancels or restarts a queue job in Project Web App.
QuotaWarningEnabledModified100This operation is in Preview. Storage quota warning modified.
RenderingEnabled101This operation is in Preview. Browser-enabled form templates will be rendered by InfoPath forms services.
ReportingAccessed102User accessed the reporting endpoint in Project Web App.
ReportingSettingModified103User modifies the reporting configuration in Project Web App.
ResourceAccessed104User accesses an enterprise resource content in Project Web App.
ResourceCheckedIn105User checks in an enterprise resource that they checked out from Project Web App.
ResourceCheckedOut106User checks out an enterprise resource located in Project Web App.
ResourceCreated107User creates an enterprise resource in Project Web App.
ResourceDeleted108User deletes an enterprise resource in Project Web App.
ResourceForceCheckedIn109User forces a checkin of an enterprise resource in Project Web App.
ResourceModified110User modifies an enterprise resource in Project Web App.
ResourcePlanCheckedInOrOut111User checks in or out a resource plan in Project Web App.
ResourcePlanModified112User modifies a resource plan in Project Web App.
ResourcePlanPublished113User publishes a resource plan in Project Web App.
ResourceRedacted114User redacts an enterprise resource removing all personal information in Project Web App.
ResourceWarningEnabledModified115This operation is in Preview. Resource quota warning modified.
SSOGroupCredentialsSet116This operation is in Preview. Group credentials set in Secure store service.
SSOUserCredentialsSet117This operation is in Preview. User credentials set in Secure store service.
SearchCenterUrlSet118This operation is in Preview. Search center URL set.
SecondaryMySiteOwnerSet119This operation is in Preview. A user has added a secondary owner to their MySite.
SecurityCategoryModified120User creates, modifies or deletes a security category in Project Web App.
SecurityGroupModified121User creates, modifies or deletes a security group in Project Web App.
SendToConnectionAdded122This operation is in Preview. Global administrator creates a new Send To connection on the Records management page in the SharePoint admin center. A Send To connection specifies settings for a document repository or a records center. When you create a Send To connection, a Content Organizer can submit documents to the specified location.
SendToConnectionRemoved123This operation is in Preview. Global administrator deletes a Send To connection on the Records management page in the SharePoint admin center.
SharedLinkCreated124User creates a link to a shared file in SharePoint or OneDrive for Business. This link can be sent to other people to give them access to the file. A user can create two types of links: a link that allows a user to view and edit the shared file, or a link that allows the user to just view the file.
SharedLinkDisabled125This operation is in Preview. User disables (permanently) a link that was created to share a file.
SharingInvitationAccepted126This operation is in Preview. User accepts an invitation to share a file or folder. This event is logged when a user shares a file with other users.
SharingRevoked127This operation is in Preview. User unshares a file or folder that was previously shared with other users. This event is logged when a user stops sharing a file with other users.
SharingSet128User shares a file or folder located in SharePoint or OneDrive for Business with another user inside their organization.
SiteAdminChangeRequest129This operation is in Preview. User requests to be added as a site collection administrator for a SharePoint site collection. Site collection administrators have full control permissions for the site collection and all subsites.
SiteCollectionAdminAdded130This operation is in Preview. Site collection administrator or owner adds a person as a site collection administrator for a SharePoint or OneDrive for Business site. Site collection administrators have full control permissions for the site collection and all subsites.
SiteCollectionCreated131This operation is in Preview. Global administrator creates a new site collection in your SharePoint organization.
SiteRenamed132This operation is in Preview. Site administrator or owner renames a SharePoint or OneDrive for Business site
StatusReportModified133User creates, modifies or deletes a status report in Project Web App.
SyncGetChanges134This operation is in Preview. User clicks Sync in the action tray on in SharePoint or OneDrive for Business to synchronize any changes to file in a document library to their computer.
TaskStatusAccessed135User accesses the status of one or more tasks in Project Web App.
TaskStatusApproved136User approves a status update of one or more tasks in Project Web App.
TaskStatusRejected137User rejects a status update of one or more tasks in Project Web App.
TaskStatusSaved138User saves a status update of one or more tasks in Project Web App.
TaskStatusSubmitted139User submits a status update of one or more tasks in Project Web App.
TimesheetAccessed140User accesses a timesheet in Project Web App.
TimesheetApproved141User approves timesheet in Project Web App.
TimesheetRejected142User rejects a timesheet in Project Web App.
TimesheetSaved143User saves a timesheet in Project Web App.
TimesheetSubmitted144User submits a status timesheet in Project Web App.
UnmanagedSyncClientBlocked145User tries to establish a sync relationship with a SharePoint or OneDrive for Business site from a computer that isn’t a member of your organization’s domain or is a member of a domain that hasn’t been added to the list of domains (called the safe recipients list) that can access document libraries in your organization. The sync relationship is not allowed, and the user’s computer is blocked from syncing, downloading, or uploading files on a document library. For information about this feature, see Use Windows PowerShell cmdlets to enable OneDrive sync for domains that are on the safe recipients list.
UpdateSSOApplication146This operation is in Preview. Target application updated in Secure store service.
UserAddedToGroup147This operation is in Preview. Site administrator or owner adds a person to a group on a SharePoint or OneDrive for Business site. Adding a person to a group grants the user the permissions that were assigned to the group.
UserRemovedFromGroup148This operation is in Preview. Site administrator or owner removes a person from a group on a SharePoint or OneDrive for Business site. After the person is removed, they no longer are granted the permissions that were assigned to the group.
WorkflowModified149User creates, modifies, or deletes an Enterprise Project Type or Workflow phases or stages in Project Web App.

See Also