#audit 4 articles
An evidence record whose "who" is written by the browser proves nothing — compare it with the server-stamped Author, and compare on the sign-in name too gotchas / lists Append-only lists let any contributor add a row with someone else's name in a text column; Author is stamped by SharePoint. Compare the two — but against Author/Name (the sign-in claim) as well, or every user whose… Purview audit objectIdFilters can return nothing — silently gotchas / graph Narrowed to one library: 0 records, no error; without the filter 1,000 records, 38 of them for that library — ask for a window, filter by object locally, A/B every server-side filter Purview audit query API — a query for a service you have no scope for still "succeeds" with 0 records gotchas / graph With only AuditLogsQuery-SharePoint.Read.All, Exchange and Entra queries return 201 → succeeded → 0 records; an unfiltered query returns only SharePoint records The Purview Audit Query API is asynchronous — think in hours, not seconds gotchas / graph Hour-long queries; attach to the last succeeded, create in background