Clarification on Deterministic Multiple Audit Logs (Unique IDs) for a Single SharePoint File Download

Hi @Ali Jone

Please note that this is a user-to-user support forum, and I am not a Microsoft Support representative. I can share my understanding based on the information available publicly, but I do not have access to Microsoft's internal SharePoint engineering systems and cannot confirm undocumented backend behavior or escalate a case directly to the product engineering team.

Regarding your 3 questions:

1.Is this caused by frontend fan-out?

Based on the behavior you described, it is possible that a single download initiated from the SharePoint modern UI results in multiple backend requests and that more than one of those requests can generate a FileDownloaded audit event. However, the fact that the records have different Id and CorrelationId values alone is not sufficient to conclusively determine that they represent frontend fan-out, authentication checks, metadata retrieval requests, or byte-range download requests.

At this time, I am not aware of any public Microsoft documentation that explicitly describes how a single SharePoint download action is mapped to one or more FileDownloaded audit records. Therefore, I cannot confirm that the three records are caused by a specific frontend fan-out mechanism.

2.Is the count of three deterministic?

I would not rely on exactly three records per download for deduplication. Even if your testing consistently produces three FileDownloaded events for downloads through the current SharePoint web UI, I would treat that as an observed behavior rather than a documented or guaranteed platform contract.

The number of underlying requests and resulting audit events could potentially vary based on service implementation details, browser behavior, file characteristics, caching, or future SharePoint Online updates. As a result, I would avoid building logic that assumes three FileDownloaded records will always correspond to a single user download action.

3.Is there specific documentation for this behavior?

I am not aware of any official Microsoft documentation that specifically describes a single SharePoint web download generating three distinct FileDownloaded audit records with different Id and CorrelationId values. The Office 365 Management Activity API documentation discusses audit events, schemas, and duplicate content delivery scenarios. However, those duplicate-delivery scenarios are different from the behavior you are describing, where multiple audit records appear to be generated for a single user action.

Because you have a reproducible case and are specifically looking for confirmation of the internal SharePoint request/auditing behavior and recommended deduplication logic, I would recommend raising a Microsoft Premier/Unified Support ticket. This would allow the case to be reviewed by the appropriate SharePoint product engineering team.

Please note that this is a paid support ticket, which means it requires an active support plan or a one-time support purchase. However, the benefit of using this channel is that your inquiry will be routed directly to the Microsoft Product Group responsible for the specific service or feature in question. This team includes engineers and developers who work on the product itself, so they are best positioned to provide accurate, in-depth, and authoritative answers especially for complex or edge-case scenarios that go beyond publicly available documentation or community knowledge. 
You can refer to this guide Open a new Support request - Microsoft Engage Center | Microsoft Learn