How can i access the event-by-event audit trail

Dear @Van Der Watt,

I hope you’re having a good day 

The information you're looking for is not stored in a single location. In Microsoft 365, the most complete audit trail comes from Microsoft Purview Audit, while actual document revisions are tracked through Version History in SharePoint and OneDrive.

For activities such as:

• Who opened or viewed a file
• Who edited or modified a file
• Sharing and access events
• Permission changes
• Deleted and restored files
• A chronological history of user activity

the primary source is Microsoft Purview Audit. Audit records can be filtered by file, user, site, activity type, and date range, and the results can be exported to CSV for analysis in Excel.

For reference: Search the audit log in Microsoft Purview

For version-by-version changes, use Version History on the document itself. This allows you to see when new versions were created, who made the changes, compare versions, and restore previous versions when needed.

For reference:View the version history of an item or file in a list or library

One important limitation to be aware of: Microsoft 365 does not typically provide a detailed record of every individual edit made inside a PowerPoint presentation or Excel workbook through audit logs. Instead, audit logs record file-level events (viewed, modified, shared, deleted, restored, downloaded, etc.), while Version History tracks the resulting document versions.

If your goal is to build a complete timeline showing who did what and when, the usual approach is to combine:

• Microsoft Purview Audit for activity history.
• Version History for document revisions.

Together, these provide the closest equivalent to an event-by-event audit trail for documents stored in SharePoint Online, OneDrive for Business, or Microsoft Teams.

I hope this information helps point you in the right direction. If you run into any issues while trying the steps, or if something still doesn’t feel quite right, please don’t hesitate to reach out again. I’ll do my best to support you however I can.   

Looking forward to hearing back from you with any updates or additional details.  

Warm regards,  

If the answer is helpful, please select "Yes, accept answer". If you have any questions or new updates, please feel free to comment below.