What level of M365/EntraID/Azure auditing is needed to unequivocally determine user activity

Shawn Goodwin 156

My company has an Entra ID P1 license. We have a couple hundred M365 Business Premium users and a handful of E5 users. We've learned some of the auditing is vague at best. Recently, while investigating user activity through the Unified Audit Portal in MS Defender, we found a lot of SharePoint FileAccessed and FilePreviewed actions for a user who should not have access to those artifacts. Digging much deeper we learned the user never actually accessed any of those files and that those events were triggered by browser prefetching and page loading. The Microsoft Audit Log Activities documentation, https://video2.skills-academy.com/en-us/purview/audit-log-activities#frequently-asked-questions-about-fileaccessed-and-filepreviewed-events, says:

Are there scenarios where a user previewing a document generates FileAccessed events? Both the FilePreviewed and FileAccessed events indicate that a user's call led to a read of the file (or a read of a thumbnail rendering of the file). While these events are intended to align with preview vs. access intention, the event distinction isn't a guarantee of the user's intent.

Essentially, the FilePreviewed and FileAccessed events are not positive indicators of definitive user activity. Are there other audit options in the Microsoft ecosystem that can be used to positively determine definitive user activity??

Thank you for your time.

edit: grammar

Marilee Turscak-MSFT 36,151 Reputation points Microsoft Employee

2024-04-01T23:09:16.31+00:00

Hi @Shawn Goodwin , when you say positively determine user activity, could you clarify if you are only asking about the FilePreviewed and FileAccessed events, or all audits in general?
Shawn Goodwin 156 Reputation points

2024-04-02T14:04:23.1766667+00:00

Thank you for your reply. That's a good question. I am more interested in the ability to positively determine user activity, with or without the FilePreviewed and/or FileAccessed events. If the audit log says a user "accessed" a file, that should mean that the user intentionally opened the file. Currently, that assertion cannot be made using FileAccessed and FilePreviewed events.
K-Mohammed 75 Reputation points Microsoft Employee

2024-07-03T13:25:38.3033333+00:00

Hi Shawn,

I'm unsure if you're still experiencing this issue, however if you are, based on this documentation the event might have been logged as a result of browser prefetch. While these events are intended to align with preview or access intention, the event distinction isn't a guarantee of the user's intent. Additionally, you can try to use the filter 'PagePrefetched' to remove the prefetched audit logs.
For more details, check out this doc: https://video2.skills-academy.com/en-us/purview/audit-log-activities

Let us know if you have any further follow up question.

Share via

What level of M365/EntraID/Azure auditing is needed to unequivocally determine user activity