Table of contents
OneDrive and Sharepoint
File activity is one of the clearest indicators of focused work inside Microsoft 365. WorkSights receives file interaction metadata from Microsoft’s audit logs, keeping your file contents fully private.
OneDrive and SharePoint activity requires audit logging to be active for your tenant. If file activity is not appearing, see Microsoft 365 Audit Log Activation.
For connection steps, see Connecting Microsoft 365.
What WorkSights Receives
WorkSights captures file actions with the file name, action type, and timestamp: accessed, modified, uploaded, downloaded, renamed, moved, and deleted, plus SharePoint page views. Renames and moves show the old and new values.
File contents, document text, revision history, and collaboration details are never received. System housekeeping events and automated operations are filtered out so timelines reflect real user activity.
How File Activity Appears
File events appear in the Files category showing the file name and action. Repeated interactions with the same file are consolidated so an editing session appears as meaningful activity rather than a stream of near-identical entries.
Because file activity comes through Microsoft's audit pipeline, it lags hours rather than minutes. There is no backfill path for files: activity accumulates from the point audit ingestion is active.
Troubleshooting
No file activity at all
Confirm audit logging is active for your tenant. File activity requires the Unified Audit Log. See Microsoft 365 Audit Log Activation. Some tenants begin producing file audit output later than others after enabling; allow additional propagation time.
File activity is missing for one user
Confirm the user is mapped and the OneDrive feature is enabled for them.
Activity appears late
This is expected. File activity arrives through the audit pipeline and lags hours, not minutes.