Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
SharePoint Embedded operations on container types are captured in the Microsoft 365 unified audit log through Microsoft Purview. These events let compliance administrators and developers track changes to container type definitions.
For general information about searching the audit log, see Search the audit log. For a broader overview of all compliance capabilities available for content stored in SharePoint Embedded, see Security and Compliance.
Container type activities
The following events are logged when a container type is created, updated, or deleted. For more information, see SharePoint Embedded container types.
These events use Workload value SharePoint in the unified audit log.
| Friendly name | Operation | Description |
|---|---|---|
| Created container type | ContainerTypeCreated | A new SharePoint Embedded container type definition was created. |
| Deleted container type | ContainerTypeDeleted | A SharePoint Embedded container type owned by the tenant was deleted. |
| Updated container type | ContainerTypeUpdated | Properties of a SharePoint Embedded container type, such as name or configuration, were changed. |
| Updated container type owners | ContainerTypeOwnersUpdated | Owners were added to or removed from a SharePoint Embedded container type. |
These events appear in the Microsoft Purview audit log under the SharePoint Embedded Container Type activities category. For the full reference of all audit activities, see Audit log activities.
Searching for SharePoint Embedded audit events
To search for these events, use the Microsoft Purview audit log search. When searching, set the activity category filter to SharePoint Embedded Container Type activities to find the relevant events.
You can also search using PowerShell:
Search-UnifiedAuditLog -Operations ContainerTypeCreated,ContainerTypeDeleted,ContainerTypeUpdated,ContainerTypeOwnersUpdated -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date)
Container type audit events include the ContainerTypeId property to identify the relevant container type. Unlike container-level file events, container type events don't include ContainerInstanceId because they apply at the type level, not to individual container instances.
Schema reference
Container type audit events use the SharePoint base schema. For the full schema definition and enum values, see the Office 365 Management Activity API schema.