PowerPoint Audit Log on SharePoint: How to View Per-Slide History

When multiple people edit a PowerPoint presentation stored on SharePoint, tracking who changed what on each slide becomes a challenge. Standard SharePoint audit logs show file-level events like view, edit, or delete but do not reveal which specific slide was modified. This article explains how to use the Microsoft 365 audit log combined with PowerPoint’s built-in version history to reconstruct per-slide change history. You will learn the exact steps to query audit data and cross-reference it with slide-level details.

Why SharePoint Audit Logs Do Not Show Slide-Level Changes

The SharePoint audit log records events at the file level. When a user saves a PowerPoint file, SharePoint logs a FileModified event. The log contains the user’s name, timestamp, IP address, and the file URL. It does not capture which slide was edited or what object was changed. This is by design — SharePoint treats the entire .pptx file as a single binary object during audit.

PowerPoint stores slide content inside a compressed XML structure. Each slide is a separate XML file within the .pptx archive. However, SharePoint does not parse this internal structure during standard audit logging. To see per-slide changes, you must combine two tools: the audit log to identify editing sessions and PowerPoint’s version history to compare slide content manually.

Steps to Reconstruct Per-Slide History Using Audit Log and Version History

Follow these steps to identify who edited a file and then determine which slides changed.

1. Open the Microsoft 365 Purview compliance portal
   Go to https://compliance.microsoft.com and sign in with a Global Admin or Audit Log viewer role. In the left navigation, select Audit.
2. Search for FileModified events for the specific file
   Under the Search tab, set the Date range to the period you want to investigate. In the Activities box, type FileModified and select it from the list. In the File field, enter the full URL of the PowerPoint file on SharePoint. Click Search.
3. Review the audit results to identify editing sessions
   The results show each time the file was saved. Note the User, Date, and Time for each event. Export the results to CSV if needed. This tells you who edited the file and when, but not which slide.
4. Open the PowerPoint file and enable version history
   In PowerPoint, open the file from SharePoint. Go to File > Info > Version History. A pane opens on the right listing all saved versions with timestamps and the user who saved each version.
5. Compare two consecutive versions to see slide-level changes
   Click the three dots (…) next to an older version and select Open Version. PowerPoint opens the older version in a separate window. Then go to Review > Compare. In the Compare dialog, browse to the newer version (the one saved later) and click Merge. PowerPoint inserts a Reviewing Pane that lists every change — new slides, deleted slides, modified text boxes, images, and formatting. Each change is tagged with the user name from the file’s metadata.
6. Repeat the Compare step for each pair of consecutive versions
   To reconstruct the full per-slide history, compare Version 1 with Version 2, then Version 2 with Version 3, and so on. This gives you a slide-by-slide change log for each editing session.

Using PowerShell to Automate Audit Log Extraction

If you need to audit many files or recurring events, you can use the Exchange Online PowerShell module to pull audit records programmatically.

1. Install the Exchange Online PowerShell module
   Run PowerShell as Administrator and enter Install-Module -Name ExchangeOnlineManagement. Confirm the installation.
2. Connect to Exchange Online
   Run Connect-ExchangeOnline and sign in with your admin credentials.
3. Search the audit log for FileModified events
   Use the Search-UnifiedAuditLog cmdlet with filters. Example:
   Search-UnifiedAuditLog -StartDate "2025-01-01" -EndDate "2025-01-31" -Operations FileModified -ObjectId "https://tenant.sharepoint.com/sites/site/Documents/presentation.pptx" | Select-Object UserIds, CreationDate, Operations
4. Export the results to CSV
   Pipe the output to Export-Csv -Path "C:\audit.csv" -NoTypeInformation. Open the CSV in Excel to filter and sort by user and date.

If Version History or Compare Is Missing Options

Version History does not appear in File > Info

This happens when the file is not saved to SharePoint or OneDrive. Version history requires the file to be stored in a SharePoint document library or OneDrive. Save the file to SharePoint first. If the file is already on SharePoint but version history is still missing, check that versioning is enabled in the library settings. Go to the SharePoint library, click the gear icon > Library Settings > Versioning Settings. Set Create major versions to True and specify a number (for example, 100).

Compare button is grayed out

The Compare feature requires two separate .pptx files. It does not work with the current file itself. Open the older version in a separate window as described in step 5. If the button remains grayed out, close all other PowerPoint windows except the two you want to compare. Also ensure both files are saved with the .pptx extension — Compare does not support .ppt or .pps files.

Compare shows changes but no user names

The Compare feature pulls user names from the file’s internal author metadata. If users edited the file without signing in to Microsoft 365, or if the file was edited in a desktop app that does not embed author names, the changes appear as “Unknown.” To fix this, enforce that all editors sign in to Microsoft 365 before editing files stored on SharePoint. You can block anonymous editing in the SharePoint library permissions.

Audit Log vs Version History: What Each Reveals About Slide Changes

Item	SharePoint Audit Log	PowerPoint Version History + Compare
Granularity	File-level events only	Slide-level and object-level changes
User identification	Yes, from Microsoft 365 login	Yes, from file metadata (may show “Unknown”)
Timestamp	Exact save time	Exact save time from version history
What changed on each slide	Not provided	Lists inserted, deleted, or modified slides and objects
Retention period	90 days (Standard) or 1 year (Premium)	As long as version history is kept in the library
Requires admin access	Yes, Global Admin or Audit Log viewer	No, any user with edit access to the file

You can now identify who edited each slide in a PowerPoint file stored on SharePoint by combining the Microsoft 365 audit log with PowerPoint’s Compare feature. Start by running an audit log search to find editing sessions, then use version history and Compare to drill into slide-level changes. For regular audits, automate the log extraction with PowerShell. To avoid missing user names, require all editors to sign in to Microsoft 365 before editing.