I wish to find out who created a particular column in a SharePoint Online document library, and auditing is enabled. When looking at a 'content type and list modification' report of the affected library, I can see a wealth of details on when something was changed - including who and when.

The only thing I can't seem to determine is what occurred during each event in the audit report - that is, I cannot find who created a particular field. When looking at the Event Data column in the audit report, every row appears exactly the same, except for the Office Online version number at the start of the value (e.g. "").

What am I missing here? Am I reading this report right?

Thanks in advance for any insights.

1 Answer 1


The OOB content type and list modification report will not give which column is created/changed by the user, it will only give the user who edit column in lists.

To get more detailed information about the column event, I recommend you use Audit log search in Office 365 Security & Compliance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.