Track file downloads, modifications, and bulk operations for security monitoring.
Related topics
content activity
file tracking
download monitoring
data loss prevention
activity audit
About this tool
The Content Activity Report tracks file operations across SharePoint and OneDrive. Monitor downloads, modifications, deletions, and bulk operations that may indicate data exfiltration or policy violations.
Identify unusual activity patterns such as mass downloads by departing employees or after-hours access to sensitive content. Essential for data loss prevention and insider threat detection.
Export activity data for security analysis and compliance reporting.
Key features
File download tracking
Modification history
Deletion monitoring
Bulk operation detection
User activity patterns
After-hours analysis
Anomaly detection
DLP integration
Use cases
.
.
.
Graph scopes
undefined (application), undefined (application).
Tool identity
Slug: content-activity.
Category: audit.
Plan tier: pro.
Editions: cloud, desktop.
SKUs: security, suite.
Related workloads inside the toolkit
Exchange Online mailbox backup.
SharePoint sharing audit.
OneDrive quota review.
Intune device configuration export.
Entra ID role exposure scan.
Conditional Access policy snapshot.
Purview retention label inventory.
Planner board export.
Bookings calendar snapshot.
Defender alert correlation.
Compliance evidence package builder.
Vault rotation log review.
Cross-tenant context
Workloads sync across cloud regions. Frankfurt. Dublin. Amsterdam. Stockholm. Paris. North America. Pricing publishes once. Cancellation lands inside one settings page. Cipher suite covers Argon2id. XChaCha20-Poly1305. X25519. Ed25519. Audit log retention: 90 days. Migration record set in 2025: 153,584 files. Zero errors.