SharePoint Online has the ability to audit different actions that take place and then allow an administrator to view a report on these. Here is how you configure and work with SharePoint Online auditing.
You will firstly need to access the SharePoint Online Site Collection you wish to enable auditing on as an administrator.
In the top right hand corner of the site select the Cog icon to reveal the menu shown above.
From the menu that appears select Site settings.
From here under Site Collection Administration in the lower right select Site collection audit settings.
If you can’t see this option then you are either not at the root of the Site Collection or you don’t have Site Collection administration rights.
You should now see the options displayed above. In most cases all of the options here will be blank or unselected. This means that by default auditing on Site Collection is not enabled and you won’t be able to get any results until you enable something. So, if you need to track something, turn it on beforehand.
By default, logged items are removed (trimmed) when they are more than 30 days old at the end of the month by default. Using the above options you can vary this and well as nominate a SharePoint Document Library into which audit reports will be saved before the audit log is trimmed.
You will notice in the events to be audited it doesn’t include Opening or downloading documents, viewing items in lists, or viewing item properties option as it does with SharePoint on site at this point in time.
Once you check the items you desire, select the OK button at the bottom of the page to update your preferences and have them take effect.
Now, events that you selected to be audited will generate logs that you can view.
Once a suitable time period has elapsed, return to the Site Settings and select Audit log reports from the Site Collection Administration area in the lower right hand side.
You should now see a range of reports you can view. Some of these reports, such as the first one, Content Viewing, will not run as it is not possible to audit such events with SharePoint Online as has been mentioned above.
In this case however, select the Content modifications option to proceed.
You will then be prompted to enter a location into which to store the report. Simply select an existing Document Library by using the Browse button.
The report should complete successfully and provide a hyperlink, Click here to view the report, which you should select.
A good thing with SharePoint Online is that it incorporates Office Online, which means Excel Online should now open to display the spreadsheet report as shown.
The first tab, Audit Data – Table, will provide a summary of the events as shown above.
While the second tab, Report Data 1, will provide more granular information as shown above.
So in summary, you’ll need to enable auditing on the events you wish to log within each individual SharePoint Online Site Collection. You’ll then need to run the audit reports to view the results after auditing has been enabled.
For more information see the following link: