When you need to audit file activity in a specific SharePoint library or OneDrive folder, the ObjectId field in Microsoft Purview’s Unified Audit Log search is your friend.

The basics

The ObjectId field filters audit events to a specific SharePoint or OneDrive location. Two things to remember:

• The URL must be fully decoded. No %20, %2F, or any other encoded characters. Use plain spaces and readable paths.

• You can use a trailing wildcard (*) to capture everything beneath a given path.

URL examples by scenario

OneDrive - specific folder and everything below it:

https://company-my.sharepoint.com/personal/user_domain_com/Documents/Admin Team/Employee Onboarding*

Note the -my.sharepoint.com domain and the personal/user_domain_com path format for OneDrive.

SharePoint - library on the default (root) site:

https://company.sharepoint.com/Shared Documents/01-Bids*

Libraries on the root site sit directly under the tenant URL with no /sites/ segment.

SharePoint - entire site:

https://company.sharepoint.com/sites/IT/*

Wildcard right after the site path catches every library and folder in that site.

SharePoint - default “Documents” library on a named site:

https://company.sharepoint.com/sites/IT/Shared Documents/*

The default document library shows up as Shared Documents in the URL, not Documents.

SharePoint - custom library on a named site:

https://company.sharepoint.com/sites/IT/Software/*

Custom libraries use their display name directly in the path.

Quick tips

If your search returns nothing and you’re sure there should be results, check for stray encoded characters first. The audit log is also not instant - expect up to 60 minutes (sometimes longer) before events appear.