SharePoint Audit Log Does Not Show File Download Events: What Site Owners Should Check

You check the SharePoint audit log to see who downloaded a sensitive file, but no events appear. This problem usually occurs because the default audit configuration in SharePoint does not log file download events. Microsoft 365 auditing must be enabled and set to log the specific operation called FileDownloaded. This article explains why download events are missing and shows site owners exactly what settings to verify and change.

Why File Download Events Are Missing from the Audit Log

SharePoint audit logging records many user actions, but file download events are not captured by default. The root cause is that the operation FileDownloaded is considered a high-volume event. Microsoft disables it by default in the standard audit log (Audit (Standard)) to reduce noise and storage costs. Only Audit (Premium) includes FileDownloaded events out of the box.

Another cause is that the audit log search in the Microsoft Purview compliance portal only shows results for the last 90 days by default. If the download happened outside that window, the event is no longer available. Additionally, some third-party sync tools or custom applications may download files using service accounts that are not audited unless explicitly configured.

Audit (Standard) vs Audit (Premium)

Microsoft 365 offers two audit tiers. Audit (Standard) is included with most business subscriptions and logs over 100 event types, but not FileDownloaded. Audit (Premium) adds FileDownloaded and other high-volume events, longer retention, and smarter search capabilities. Site owners with an E5 or A5 license have Audit (Premium) included. Others must purchase an add-on license.

Steps to Enable and Verify File Download Auditing

1. Turn on auditing for the tenant
   Go to the Microsoft Purview compliance portal at compliance.microsoft.com. Select Audit from the left navigation. If auditing is not already turned on, you see a banner that says Start recording user and admin activity. Click the Start recording button. This enables Audit (Standard) for the entire tenant. Wait up to 24 hours for the setting to apply.
2. Check if Audit (Premium) is available
   In the same Audit section, look for the Audit (Premium) tab. If you do not see it, your subscription may not include it. Go to Settings > Subscription in the compliance portal to verify your license. Only E5, A5, and G5 licenses include Audit (Premium) without extra cost.
3. Enable FileDownloaded logging with PowerShell
   Open Exchange Online PowerShell as an administrator. Run the command: Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true. Then run: Set-AdminAuditLogConfig -OperationsToLog FileDownloaded. This ensures the FileDownloaded operation is included in the audit stream. Note that this setting may take up to 30 minutes to take effect.
4. Search for file download events
   In the Microsoft Purview compliance portal, go to Audit > Search. Set the Activities filter to File and page activities and select File downloaded. Enter the date range and user name if known. Click Search. If events still do not appear, use PowerShell: Search-UnifiedAuditLog -Operations FileDownloaded -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date).
5. Verify that the file was downloaded from a browser or sync client
   File downloads from the SharePoint web interface are logged as FileDownloaded. Downloads from the OneDrive sync client are logged as FileSyncDownloadedFull. If you are searching only for FileDownloaded, you will miss sync client events. Include both operation types in your search.

If SharePoint Still Does Not Show File Download Events

Audit log search returns zero results for FileDownloaded

If you enabled all settings but still see no events, confirm that the user who performed the download has an active Microsoft 365 license. Unlicensed users are not audited. Also check if the file was downloaded from a SharePoint site that is set to Read-only or No access for that user. If the download did not succeed, the event is not logged.

File download events appear in PowerShell but not in the web UI

The web UI search has a limit of 5,000 results per query. If your tenant has many download events, the web UI may display only a subset. Use the PowerShell cmdlet Search-UnifiedAuditLog with the -ResultSize parameter set to 5000 to retrieve all matching events. Then filter the results in Excel or a script.

Download events from external sharing links are missing

When an anonymous user downloads a file via a sharing link, the event is logged under the operation AnonymousLinkUsed. It is not logged as FileDownloaded. To capture these downloads, search for AnonymousLinkUsed in addition to FileDownloaded. Anonymous link events include the file name and the time of access.

Item	Audit (Standard)	Audit (Premium)
License requirement	E1, E3, Business Basic, Business Standard, or equivalent	E5, A5, G5, or add-on license
File download events (FileDownloaded)	Not included	Included by default
Retention period	90 days	1 year (up to 10 years with add-on)
PowerShell search support	Yes	Yes
Anonymous link download events	Logged as AnonymousLinkUsed	Logged as AnonymousLinkUsed

Now you can check your tenant audit configuration and enable the correct settings to capture file download events. Start by verifying your license tier and turning on Audit (Premium) if available. Then use the PowerShell commands to enable FileDownloaded logging and search for past events. For anonymous downloads, remember to search for the AnonymousLinkUsed operation as well.