Understanding the User activity logs report

The User activity logs report shows you when users took different actions in OneDrive for Business. Following are descriptions of the events recorded in your User activity logs report.

Internal users are users within your Office 365 subscription, and external users are any users that do not belong to your user list within Office 365.

Note: The OneDrive for Business User activity logs report is in Beta. Data will be accurate, but the appearance of this report and the underlying schema of this report may change over time.

Collaboration activities

• AccessInvitationAccepted:    This event is captured when a user accepts an external user invitation to access a file or folder.

• AccessInvitationCreated:    This event is captured when a user invites an external user to access a file or folder.

• AccessInvitationExpired:    This event is captured automatically after 7 days, when an invitation to external user has not been acted upon.

• AccessInvitationRevoked:    This event is captured when a user revokes an external user invitation to a file or folder.

• AccessInvitationUpdated:    This event is captured when a user updates an existing external user invitation.

• AccessRequestApproved:    This event is captured when a user approves an internal user to access a file or folder.

• AccessRequestCreated:    This event is captured when an internal user requests to access another user's file or folder for which he or she does not have permissions.

• AccessRequestExpired:    This event is captured automatically after 7 days, when an access request has not been acted upon by user.

• AccessRequestRejected:    This event is captured when a user rejects an internal user request to access a file or folder

File access and management

• FileCheckedIn:    This event is captured when a user checks in a file that was previously checked out.

• FileCheckedOut:    This event is captured when a user checks out a file. This also prevents other users from saving changes.

• FileCheckedOutDiscarded:    This event is capture when a user discards the lock on a previously checked out file.

• FileCopied:    This event is captured when a user creates a copy of a file located in a document library.

• FileDeleted:    This event is captured when the user deletes a file from the OneDrive for Business clients.

• FileDownloaded:    This event is captured when the user downloads a copy of a file to his or her hard drive.

• FileModified:    This event is captured when a user saves a file or when a file is auto-saved.

• FileMoved:    This event is captured when a user moves a file located in document library into another folder located in document library.

• FileRenamed:    This event is captured when a user renames a file.

• FileRestored:    This event is captured when a user restores his or her file from the site recycling bin.

• FileUploaded:    This event is captured when a user uploads a file to a document library.

• FileViewed:    This event is captured when a user views a file from Office Online apps. Other views captured capture of other view events will be added during the Beta period.

File sharing

• SharedLinkCreated:    This event is captured when a user creates a View or Edit link.

• SharedLinkDisabled:    This event is captured when a user disables a sharing link; in other words, the previously created link will not be accessible anymore.

• SharingRevoked:    This event is captured when a user revokes the sharing permission to a file or folder to a designated user, in other words the designated user will not have access to the resource

• SharingSet:    This event is capture when a user creates or updates a permission sharing to a file or folder.

Known issues

• The User activity reports cannot currently distinguish between a client and server operating system. For example, the report shows the client operating system name, but the user could have accessed OneDrive for Business from the server operating system. This is because the report parses the User Agent string of the request to extract device, operating system, and application information. The report retrieves a value like "Windows NT 6.2" for operating system, which could be either "Windows 8" or Windows Server 2012.

• In the Parent folder name column, currently the value is showing up with an extra backslash. Right now it is "Documents\/Pictures" instead of "Documents/Pictures." We are working on a fix for this issue.