Is there a way in SharePoint online to find out what user account changed the permissions on a Document Library folder?

3 Answers 3


You can use Unified Audit Log in Office 365 to identify the user.

In the Microsoft Admin center, you can navigate to https://protection.office.com/unifiedauditlog, add the URL of your site (append it with an asterisk) and you can filter the results.


According to my research, I'm afraid your needs can't be met.

The original site-level audit log has the option of Editing users and permissions, but SharePoint online no longer support choosing specific events to edit. Audit Log Reports will still be available as usual but powered by the Unified Audit Pipeline.

Audit Log in Office 365 doesn't seem to record folder-level permission changes.

enter image description here

Even if I choose modify the folder, it doesn't display information about permissions

enter image description here

  • "Shared file, folder or site" is the one that worked for me Commented Jan 16, 2020 at 5:13

Maybe View audit log reports works for you.

  • Security settings Reports changes to security settings, such as user/group events, and role and rights events.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.