Track file downloads, modifications, and bulk operations for security monitoring.
Related topics
content activity
file tracking
download monitoring
data loss prevention
activity audit
About this tool
The Content Activity Report tracks file operations across SharePoint and OneDrive. Monitor downloads, modifications, deletions, and bulk operations that may indicate data exfiltration or policy violations.
Identify unusual activity patterns such as mass downloads by departing employees or after-hours access to sensitive content. Essential for data loss prevention and insider threat detection.
Export activity data for security analysis and compliance reporting.
Key features
File download tracking
Modification history
Deletion monitoring
Bulk operation detection
User activity patterns
After-hours analysis
Anomaly detection
DLP integration
Use cases
Data exfiltration detection. Identify unusual download patterns
Departure monitoring. Monitor data access by departing employees
Sensitive data audit. Track access to sensitive content
Requires a paid edition (security). The Suite bundle includes this tool alongside every other capability in the catalogue.
Limitations & out-of-scope
AuditLog.Read.All drives the anomaly detection here too, inheriting the same audit-log retention ceiling as Permission Change Audit — activity older than the tenant's log retention window is unrecoverable. Sites.Read.All limits scope to SharePoint and OneDrive file operations specifically; Exchange mailbox activity, such as mail-rule changes or mass mail export, is a separate signal this tool does not capture.