Track file downloads, modifications, and bulk operations for security monitoring.
Related topics
content activity
file tracking
download monitoring
data loss prevention
activity audit
About this tool
The Content Activity Report tracks file operations across SharePoint and OneDrive. Monitor downloads, modifications, deletions, and bulk operations that may indicate data exfiltration or policy violations.
Identify unusual activity patterns such as mass downloads by departing employees or after-hours access to sensitive content. Essential for data loss prevention and insider threat detection.
Export activity data for security analysis and compliance reporting.
Key features
File download tracking
Modification history
Deletion monitoring
Bulk operation detection
User activity patterns
After-hours analysis
Anomaly detection
DLP integration
Use cases
.
.
.
Graph scopes
undefined (application), undefined (application).
Tool identity
Slug: content-activity.
Category: audit.
Plan tier: pro.
Editions: cloud, desktop.
SKUs: security, suite.
Documented scenarios: 3.
Declared features: 8.
Graph permissions requested: 2.
Licensing & access
Requires a paid edition (security). The Suite bundle includes this tool alongside every other capability in the catalogue.
Limitations & out-of-scope
Content Activity Report: Detective control only: findings are reported, never auto-remediated. Severity rankings use the documented heuristic and may diverge from Microsoft Secure Score. Detection coverage stops at the Graph permission surface declared above — workloads behind tenant-licensed add-ons (Defender XDR, Purview eDiscovery Premium) require the matching license to enumerate.