Track doc move

Question

We have a doc in a doc library that was probably moved from one folder to another. We would like to find out who moved it and when.

Purview Audit has not helped so far.

Answer 1

Dear Hanif888,

Thank you for your response. I understand your concern; it can be very frustrating. Based on your description, if you remember the file or folder name, you can try searching for it using that name.

Thank you for your understanding. Your cooperation and contributions are greatly appreciated.

Kind Regards,

Nahid Sultan

Answer 2

Thanks for that Nahid. The file was presumbly moved from main doc library to another within the same site some time ago. And once discovered the user moved it back to the main doc lib last week.

I have done a few audits in Purview looking for file move but it has not found anything. It has not even found the move that was carried out last week.

In the file/folder field should I be supplying the current doc link or should I supply the doc title?

Answer 3

Dear Hanif888,                                                                    

Good day to you!

I hope you are doing well. Thanks for reaching out to our Microsoft Community Forum. We will be happy to help you.

According to your description, you would like to find out who moved a file from one location to another in SharePoint. As we know, actions such as document edits, deletions, and other modifications can only be tracked via the Audit Log. There is no default setting in SharePoint that allows tracking file movements outside of audit logs.

In SharePoint, most file actions (edit, delete, rename, and move) should be captured in the Unified Audit Log via Microsoft Purview Compliance Center. However, sometimes move actions are recorded as "File Renamed" instead of "File Moved."

If auditing wasn’t enabled before the file was moved, there won’t be any records. If the file was moved within the same document library, it may not always be logged explicitly as "moved." Some basic licenses (E3 and below) have limited logging capabilities.

May I know what results you found in the Audit Log? Are you unable to identify who moved the file, or is the move action itself missing from the audit log?

I am looking forward to your response for further assistance.

Thank you for your understanding. Your cooperation and contributions are greatly appreciated.

Kind Regards,

Nahid Sultan