...
...
Description
SharePoint file operation events.
Log Structure
| Expand |
|---|
| title | Sample Office365SharePointFileOperation log |
|---|
|
[
{
"AppAccessContext": {
"AADSessionId": "9a8cf76d-d754-3e2e-b10d-9bb87654f3b2",
"CorrelationId": "123455a0-807b-1111-cd61-7e477227f33a",
"UniqueTokenId": "aBCde-XYZUm77sUdZIgDDD"
},
"CreationTime": "2022-03-01T02:38:44",
"Id": "80c76bd2-9d81-4c57-a97a-accfc3443dca",
"Operation": "FileAccessed",
"OrganizationId": "41463f53-8812-40f4-890f-865bf6e35190",
"RecordType": 6,
"UserKey": "1153977025279851686@contoso.onmicrosoft.com",
"UserType": 0,
"Version": 1,
"Workload": "SharePoint",
"ClientIP": "134.170.188.221",
"ObjectId": "https://contoso-my.sharepoint.com/User Photos/Profile Pictures/admin_contoso_onmicrosoft_com_MThumb.jpg",
"UserId": "admin@contoso.onmicrosoft.com",
"CorrelationId": "123455a0-807b-1111-cd61-7e477227f33a",
"DoNotDistributeEvent": true,
"EventSource": "SharePoint",
"ItemType": "File",
"ListId": "f1c23344-5667-890f-1234-8ee1171747ad",
"ListItemUniqueId": "a11111bc-8394-40d1-8e2f-a0b6c3334455",
"Site": "9876ded5-e4df-32e1-b123-bcec4d5ce67a",
"UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36",
"WebId": "7777777a8-d0b9-001f-be0b-f9c12345cd48",
"HighPriorityMediaProcessing": false,
"SourceFileExtension": "jpg",
"SiteUrl": "https://contoso-my.sharepoint.com/",
"SourceFileName": "admin_contoso_onmicrosoft_com_MThumb.jpg",
"SourceRelativeUrl": "User Photos/Profile Pictures"
}
] |
Table Fields
Field | Description |
|---|
TABLE | Office365SharePointFileOperation |
RECORDTYPE | RecordType is “6”, more details about RecordType here. |
AADSESSIONID | AADSessionId - Value will be based on AppAccessContext→AADSessionId |
SITEURL | SiteUrl - The URL of the site where the file or folder accessed by the user is located. |
SRCRELATIVEURL | SourceRelativeUrl - The URL of the folder that contains the file accessed by the user.
The combination of the values for the SiteURL, SourceRelativeURL, and SourceFileName parameters is the same as the value for the ObjectID property, which is the full path name for the file accessed by the user. |
SRCFILENAME | SourceFileName - The name of the file or folder accessed by the user. |
SRCFILEEXTENSION | SourceFileExtension - The file extension of the file that was accessed by the user. This property is blank if the object that was accessed is a folder. |
DSTRELATIVEURL | DestinationRelativeUrl - The URL of the destination folder where a file is copied or moved.
The combination of the values for SiteURL, DestinationRelativeURL, and DestinationFileName parameters is the same as the value for the ObjectID property, which is the full path name for the file that was copied.
This property is displayed only for FileCopied and FileMoved events. |
DSTFILENAME | DestinationFileName - The name of the file that is copied or moved.
This property is displayed only for FileCopied and FileMoved events. |
DSTFILEEXTENSION | DestinationFileExtension - The file extension of a file that is copied or moved.
This property is displayed only for FileCopied and FileMoved events. |
USERSHAREWITH | UserSharedWith - The user that a resource was shared with. |
SHARINGTYPE | SharingType - The type of sharing permissions that were assigned to the user that the resource was shared with.
This user is identified by the UserSharedWith parameter. |
LISTID | ListId - The Guid of the list. This information is present only if it is applicable. |
LISTITEMUNIQUEID | ListItemUniqueId - The ID of the application performing the operation. |
WEBID | WebId - No available documentation for this field. |
FILESIZE | FileSizeBytes - No available documentation for this field. |
HIGHPRIOMEDIAPROC | HighPriorityMediaProcessing - No available documentation for this field. |
IMPLICITSHARE | ImplicitShare - No available documentation for this field. |
SNAREDATAMAP | All unclassified field/s in the log will be pushed into the SNAREDATAMAP. |
Note: See other fields here, which are common among all SharePoint* log types.
Notes
https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema?view=o365-worldwide#sharepoint-file-operations