Is SharePoint Subsite Creation Available in Microsoft Purview Audit Logs?

Yuvan Kesav A 40 Reputation points
2026-09-14T09:52:06.3233333+00:00

We are looking for audit/log data that can identify SharePoint subsites that were created within a tenant.

We checked the Microsoft Purview Audit data for SharePoint-related operations. We can find operations such as SiteCollectionCreated, but we could not find a specific operation that represents subsite creation.

We are aware that Microsoft Graph /sites/delta can be used to identify changes to sites, and we can use that approach if necessary. However, we specifically want to know whether the same information is available through Microsoft Purview / Unified Audit Log data.

Could you please clarify:

  1. Is there a Purview Audit operation/event that records SharePoint subsite creation?
  2. If there is no dedicated SubsiteCreated operation, is subsite creation captured under any other existing SharePoint audit operation?
  3. Is there any way to identify newly created subsites, including nested subsites, from the available audit data?

We are specifically looking for a way to obtain subsite creation as historical/log data through the audit system, rather than performing site enumeration.

Microsoft 365 and Office | SharePoint | Development
0 comments
Answer accepted by question author
Ana Le 2,600 Reputation points Independent Advisor
2026-09-14T10:24:42.75+00:00

Hi,

Your observation is consistent with the currently documented Microsoft Purview Audit schema.

Microsoft documents SiteCollectionCreated as an operation generated when a new SharePoint site collection is created or a user’s OneDrive site is provisioned. Microsoft also notes that creating a Microsoft 365 group or team can generate a site-collection creation record. However, the current Audit log activities reference does not list a SubsiteCreated or WebCreated operation.

A SharePoint subsite is a child web within an existing site collection. Its creation is not documented as being covered by SiteCollectionCreated, and there is no other documented Unified Audit Log operation that can be treated as an equivalent subsite-creation event.

This does not mean that activity within a subsite is excluded from auditing. Subsequent file, list, sharing, or permission events may contain the subsite URL in properties such as SiteUrl or ObjectId. However, these events only show that an action occurred in that subsite. They do not establish when the subsite was created. Using the earliest available activity as a proxy would therefore be incomplete and unreliable.

Consequently, Purview Audit data alone cannot reliably provide a historical list of newly created subsites, including nested subsites.

For subsites that still exist, GET /sites/{site-id}/sites can be queried recursively, and the returned site resource includes createdDateTime. This is current site metadata rather than an audit event and cannot identify subsites that have already been deleted.

For future change tracking without performing a full enumeration each time, /sites/delta can be used and the returned changes stored externally. That history would be maintained by the application rather than being Microsoft Purview audit data.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.