Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

...

Description

SharePoint file operation events.

Log Structure

Expand
titleSample Office365SharePointFileOperation logof Office365SharePointFileOperation Event (in JSON format)
[
{
"AppAccessContext": {
"AADSessionId": "9a8cf76d-d754-3e2e-b10d-9bb87654f3b2",
"CorrelationId": "123455a0-807b-1111-cd61-7e477227f33a",
"UniqueTokenId": "aBCde-XYZUm77sUdZIgDDD"
},
"CreationTime": "2022-03-01T02:38:44",
"Id": "80c76bd2-9d81-4c57-a97a-accfc3443dca",
"Operation": "FileAccessed",
"OrganizationId": "41463f53-8812-40f4-890f-865bf6e35190",
"RecordType": 6,
"UserKey": "1153977025279851686@contoso.onmicrosoft.com",
"UserType": 0,
"Version": 1,
"Workload": "SharePoint",
"ClientIP": "134.170.188.221",
"ObjectId": "https://contoso-my.sharepoint.com/User Photos/Profile Pictures/admin_contoso_onmicrosoft_com_MThumb.jpg",
"UserId": "admin@contoso.onmicrosoft.com",
"CorrelationId": "123455a0-807b-1111-cd61-7e477227f33a",
"DoNotDistributeEvent": true,
"EventSource": "SharePoint",
"ItemType": "File",
"ListId": "f1c23344-5667-890f-1234-8ee1171747ad",
"ListItemUniqueId": "a11111bc-8394-40d1-8e2f-a0b6c3334455",
"Site": "9876ded5-e4df-32e1-b123-bcec4d5ce67a",
"UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36",
"WebId": "7777777a8-d0b9-001f-be0b-f9c12345cd48",
"HighPriorityMediaProcessing": false,
"SourceFileExtension": "jpg",
"SiteUrl": "https://contoso-my.sharepoint.com/",
"SourceFileName": "admin_contoso_onmicrosoft_com_MThumb.jpg",
"SourceRelativeUrl": "User Photos/Profile Pictures"
}
]

Table Fields

Field

Description

TABLE

Office365SharePointFileOperation

RECORDTYPE

Based on RecordType is “6”, more details about RecordType , this field indicates the operation performed by the record.
For this log type its value is 6
For available RecordType values, you can visit Microsoft’s documentation here.

AADSESSIONIDAADSessionId

- Value will be based on AppAccessContext→AADSessionIdBased on AADSessionId, a value derived from the AppAccessContext field.

SITEURL

SiteUrl - The Based on SiteUrl, this field contains the URL of the site where the file or folder accessed by the user is located.

SRCRELATIVEURL

SourceRelativeUrl - The Based on SourceRelativeUrl, this field contains the URL of the folder that contains the file accessed by the user.The combination of the values for the SiteURLSourceRelativeURL, and SourceFileName parameters is the same as the value for the ObjectID property, which is the full path name for the file accessed by the user.

SRCFILENAME

SourceFileName - The SRCFILENAME

Based on SourceFileName, this field contains the name of the file or folder accessed by the user.

SRCFILEEXTENSION

SourceFileExtension - The Based on SourceFileExtension, this field contains the file extension of the file that was accessed by the user. This property is blank if the object that was accessed is a folder.

DSTRELATIVEURL

DestinationRelativeUrl - The Based on DestinationRelativeUrl, this field contains the URL of the destination folder where a file is copied or moved.The combination of the values for SiteURLDestinationRelativeURL, and DestinationFileName parameters is the same as the value for the ObjectID property, which is the full path name for the file that was copied.
This property is displayed only for FileCopied and FileMoved events.

DSTFILENAME

DestinationFileName - The name DSTFILENAME

Based on DestinationFileName, this field contains the name of the file that is copied or moved.
This property is displayed only for FileCopied and FileMoved events.

DSTFILEEXTENSION

DestinationFileExtension - The Based on DestinationFileExtension, this field contains the file extension of a file that is copied or moved.This property is displayed only for FileCopied and FileMoved events.

USERSHAREWITH

UserSharedWith - The Based on UserSharedWith, this field contains the user that a resource was shared with.

SHARINGTYPE

SharingType - The Based on SharingType, this field contains the type of sharing permissions that were assigned to the user that the resource was shared with.
This user is identified by the UserSharedWith parameter.

LISTID

ListId - The Based on ListId, this field contains the Guid of the list. This information is present only if it is applicable.

LISTITEMUNIQUEID

ListItemUniqueId - The Based on ListItemUniqueId, this field contains the ID of the application performing the operation.

WEBID

WebId - No Based on WebId, there’s no available documentation for this field.

FILESIZE

FileSizeBytes - No Based on FileSizeBytes, there’s no available documentation for this field.

HIGHPRIOMEDIAPROC

HighPriorityMediaProcessing - No Based on HighPriorityMediaProcessing, there’s no available documentation for this field.

IMPLICITSHARE

ImplicitShare - No Based on ImplicitShare, there’s no available documentation for this field.

SNAREDATAMAP

All unclassified field/s in the log (s) parsed from this log type will be pushed into the SNAREDATAMAP.

Note: See other fields here, which are common among all SharePoint* log types.

Notes

https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema?view=o365-worldwide#sharepoint-file-operations