Mass Download & Deletion Activity (7 days)

The question it answers: Who downloaded or deleted an unusual number of SharePoint and OneDrive files in one hour in the last 7 days?

Someone downloading hundreds of files in an hour before they leave, or a compromised account deleting whole libraries, shows up as a spike in the audit log. Per user: downloads and deletions over the last 7 days and their busiest single hour.

Note

Thresholds per hour: 100+ downloads or 50+ deletions = review, 500+ / 200+ = act. Sync clients (OneDrive sync of a whole library) also create download spikes. At most 200,000 records are read; hours are UTC.

At a glance

Where in the app	Tenant › Compliance & Audit › Mass Download & Deletion
Workload	Compliance
Kind	Table · dashboard tile
Data	A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan.
Licence	Microsoft Purview Audit (Standard) - included in Microsoft 365 E3 / Business Premium.
Report id (API and MCP)	tenant.compliance.mass-file-activity

Columns

Column	Key	Type
User	UserPrincipalName	Text
Peak hour downloads	PeakHourDownloads	Status
Peak hour deletions	PeakHourDeletions	Text
Peak hour	PeakHour	DateTime
Downloads (7 d)	Downloads	Text
Deletions (7 d)	Deletions	Text
Sites	Sites	Text
Client IPs	ClientIps	Text
Last event	LastEvent	DateTime

Filters

Filter	Key (API)	On when the page opens
Only users with an unusual hour	unusual	Yes

What it needs

Licence: Microsoft Purview Audit (Standard) - included in Microsoft 365 E3 / Business Premium.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
AuditLogsQuery.Read.All	Microsoft Graph	Read audit logs data from all services

Data sources it reads

• POST /v1.0/security/auditLog/queries (sharePointFileOperation)
• GET /v1.0/security/auditLog/queries/{id}
• GET /v1.0/security/auditLog/queries/{id}/records

Through the API and MCP

GET /ir-api/v1/reports/tenant.compliance.mass-file-activity?size=100
GET /ir-api/v1/reports/tenant.compliance.mass-file-activity?filter=unusual
POST /ir-api/v1/reports/tenant.compliance.mass-file-activity/scan

An AI assistant reads it with the MCP tool get_report and the id tenant.compliance.mass-file-activity. The client needs the Run scan grant for Compliance. See Using the API.