Audit Log Does Not Show OneDrive Download Events: OneDrive for Business Fix

You check the Microsoft 365 audit log to see who downloaded a file from OneDrive, but the Download event is missing. This happens even though other file events like Upload and Delete appear correctly. The root cause is a default setting in the OneDrive sync app that suppresses download audit events for synced files. This article explains why Download events are missing and provides the exact steps to enable them in your tenant.

Why OneDrive Download Events Are Missing from the Audit Log

The OneDrive sync app on Windows uses a background process to download files. When a user opens a synced file from File Explorer, the sync app downloads it silently. By default, Microsoft 365 does not log these sync-initiated downloads in the Unified Audit Log. This is by design to reduce audit log noise from routine sync operations.

However, this default behavior hides actual user-initiated downloads when they happen through the sync app. For example, if a user opens a synced Excel file by double-clicking it in File Explorer, the action is a download, but no FileDownloaded event appears in the audit log. Direct downloads from the OneDrive web portal are still logged. The missing events affect only files downloaded through the sync app.

Microsoft added a tenant-level setting to control this behavior. The setting is off by default. Turning it on makes the OneDrive sync app report download events to the audit log. The change applies to all users in the tenant. No client-side configuration is required.

Steps to Enable OneDrive Download Audit Events

You must be a Microsoft 365 Global Administrator or SharePoint Administrator to perform these steps.

1. Open the Microsoft 365 admin center
   Go to admin.microsoft.com and sign in with your admin account.
2. Navigate to Org settings
   In the left navigation pane, select Show all then Settings. Click Org settings.
3. Open the OneDrive settings page
   On the Services tab, scroll down and click OneDrive.
4. Enable download audit events
   On the OneDrive settings page, find the Audit section. Check the box labeled Allow download events in audit logs.
5. Save the setting
   Click Save at the bottom of the pane. The change takes effect within 30 minutes for all users.

Verify the Setting in the Unified Audit Log

1. Go to Microsoft 365 Defender
   Open security.microsoft.com and sign in with your admin account.
2. Open the Audit log
   In the left navigation, select Audit under the Reports section.
3. Search for download events
   Click the Search tab. Under Activities, type FileDownloaded and select it. Set a date range that includes the time after you enabled the setting. Click Search.
4. Confirm results
   If the setting is active, download events from the sync app appear in the results. If not, wait 30 minutes and search again.

Enable Download Audit Events Using PowerShell

You can also enable the setting with the SharePoint Online Management Shell. This method is useful for automation or when you need to apply the setting across multiple tenants.

1. Install and connect to SharePoint Online
   Open Windows PowerShell as an administrator. Run Install-Module -Name Microsoft.Online.SharePoint.PowerShell if you have not installed the module. Then run Connect-SPOService -Url https://yourtenant-admin.sharepoint.com and sign in with your admin account.
2. Enable the download audit setting
   Run the following command:
   Set-SPOTenant -EnableDownloadAuditEvents $true
3. Verify the setting
   Run Get-SPOTenant | Select EnableDownloadAuditEvents. The output should show True.

If Download Events Still Do Not Appear After Enabling the Setting

Audit log search shows no FileDownloaded events at all

The Unified Audit Log must be turned on for your tenant. Go to Microsoft 365 Defender > Audit > Search. If you see a banner that says “Start recording user and admin activity,” click Turn on auditing. This is a separate prerequisite. Without it, no audit events are logged at all.

FileDownloaded events appear only for web downloads

After enabling the setting, only new downloads through the sync app are logged. Files that were already synced before the setting was enabled do not generate audit events when opened. Users must close and reopen the file, or the sync app must re-download it. To test, have a user delete a synced file from their local OneDrive folder and let the sync app download it again. That download will appear in the audit log.

Audit log shows FilePreviewed but not FileDownloaded

FilePreviewed events occur when a user opens a file in the OneDrive web preview pane without downloading it. This is a separate event type. If you need to track previews, search for FilePreviewed in the Activities filter. The EnableDownloadAuditEvents setting does not affect preview events.

Audit Log Events: Download vs Sync vs Preview

Event Type	When It Occurs	Logged by Default
FileDownloaded	User downloads a file from OneDrive web or sync app	Only for web downloads; sync app requires setting
FileSynced	OneDrive sync app updates a file in the background	Yes
FilePreviewed	User opens a file in the web preview pane	Yes

The table shows that FileDownloaded is the only event affected by the EnableDownloadAuditEvents setting. FileSynced and FilePreviewed are always logged. If you see FileSynced events but not FileDownloaded, the setting is still off.

You can now enable OneDrive download audit events in your tenant using the admin center or PowerShell. After turning on the setting, new sync app downloads will appear in the Unified Audit Log as FileDownloaded events. For immediate verification, use the Microsoft 365 Defender audit search with the FileDownloaded activity filter. As an advanced tip, combine this setting with audit retention policies in Microsoft 365 Purview to keep download records for up to 10 years for compliance requirements.