Created by Claude - please verify

Mass file activity - Purview audit log search (SharePoint / OneDrive file operations) run on demand; the search itself takes several minutes.

Required Microsoft Graph permissions

AuditLogsQuery.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Purview Audit (Standard) - included in Microsoft 365 E3 / Business Premium.

Endpoints: POST /v1.0/security/auditLog/queries (sharePointFileOperation) · GET /v1.0/security/auditLog/queries/{id} · GET /v1.0/security/auditLog/queries/{id}/records

Thresholds per hour: 100+ downloads or 50+ deletions = review, 500+ / 200+ = act. Sync clients (OneDrive sync of a whole library) also create download spikes. At most 200,000 records are read; hours are UTC.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Mass Download & Deletion Activity (7 days)

Someone downloading hundreds of files in an hour before they leave, or a compromised account deleting whole libraries, shows up as a spike in the audit log. Per user: downloads and deletions over the last 7 days and their busiest single hour.

Press Run scan to search 7 days of SharePoint and OneDrive downloads and deletions (takes several minutes).