How to read the SharePoint Security Audit Report

User request to check who's remove the permission !!!   As a SharePoint Admin we can get the information from the audit report ( anyway need to enable it before else will not have data available)

Site Settings > Audit log Reports : Select the Security settings

Once you get the report , we can get the information from the report .

Information below from the column good enough to find out who change the permission


User ID : Person done the change

Event Data : what permission is change (but is in number , so the number is represent the role showed as following )


Full Control 1073741829
Contribute 1073741827
Read 1073741826


This id is given by SharePoint , you can get it by do some programming or script.

1. Go to the sites with /_layouts/15/people.aspx?MembershipGroupId=0
2. You will see all the user over here, mouse over the id then you can see the left hand side bottom have the full URL detail showed . you can see the id here.

This information is showed what change is going on