What is a one sentence summary of your feature request?
SharePoint Online: flag Activity Records where preview and download are indistinguishable in the source audit data
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
PROBLEM
For certain file types in SharePoint Online — PDF being the most common — Microsoft records the exact same native operation (FileDownloaded) whether the user simply opens the document in the built-in browser viewer or deliberately downloads it to their device. This happens because the SharePoint PDF viewer internally uses a file-download operation to retrieve the content.
As a result, Netwrix Auditor reports both actions identically:
Action: Read
Details: Action: Document downloaded
We verified this with a controlled test on Auditor 10.9 (build 16393):
- Opened a PDF in the SharePoint built-in viewer only — no file saved to disk
- Downloaded the same PDF using the download button inside the viewer§
- Downloaded a different PDF via the library Download command
All three actions produced Activity Records that are identical in every visible field (Object type, Action, Details, Workstation, Account). Netwrix Technical Support reproduced the scenario and confirmed that no field, filter or Monitoring Plan configuration can currently distinguish them, as the distinction is not present in the source audit event.
SCOPE IS CURRENTLY UNKNOWN
Netwrix Support confirmed that some formats are handled correctly: .log and .docx files generate distinct preview and download events. However, Netwrix also confirmed that no complete list of affected file types is currently available, and that formats such as XLSX, PPTX, PNG, JPG, TIFF, MP4, MOV, MSG and EML cannot be confirmed as unaffected in every scenario.
This is arguably the most problematic aspect. The issue is neither universal nor limited to a single format — it is undetermined. An auditor reading a report today has no way of knowing which “Document downloaded” records are reliable and which are not, and no documentation to refer to. Since this behaviour is a property of SharePoint Online and therefore identical across all tenants, the affected formats could be identified once and applied for every customer.
WHY THIS MATTERS
Organisations auditing documentation libraries — technical manuals, work instructions, procedures, policies — typically store them as PDF. In those libraries, a large share of “Document downloaded” records are in fact simple on-screen consultations. Download figures in reports, alerts and compliance reviews are therefore significantly overstated, and an auditor has no way of knowing which records are reliable.
PROPOSED SOLUTION
We are not asking Netwrix to determine whether a file was actually saved locally — that depends on Microsoft exposing additional information and would require endpoint-side evidence.
What we are asking is that Netwrix Auditor makes the ambiguity visible:
- Identify and maintain the list of affected file types. This is a property of SharePoint Online, identical for every tenant, so it needs to be determined only once
- Add an indicator (flag, additional Details line, or a dedicated column) on Activity Records whose file type is known to produce indistinguishable preview and download events
- Make that indicator usable as a search filter, so that reports and alerts can include or exclude ambiguous records
- Document the affected formats publicly, so customers can interpret existing reports correctly
This is entirely feasible within Auditor, since it only requires evaluating the file extension against a known list — no additional data from Microsoft is needed.
WHY THIS IS THE BEST APPROACH
An auditing product should never present ambiguous data as if it were certain. Flagging the records preserves full transparency, requires no change to the customer’s document formats or processes, and immediately restores confidence in the reports for the file types that are not affected.
How do you currently solve the challenges you have by not having this feature?
We currently have no reliable way to solve it.
The workaround suggested by Netwrix Support — publishing documentation in DOCX instead of PDF, since Office formats record preview and download as separate events — is not applicable in our environment. PDF is our publishing format for technical documentation distributed outside the IT department; converting the library would break layout fidelity, change the end-user experience and require reworking our entire publishing process.
In practice we are left with three unsatisfactory options:
- Treat every “Document downloaded” record as a genuine download, knowing the figures are significantly overstated
- Manually cross-check individual records against the native audit data, which is not viable for periodic reporting
- Ignore download metrics for PDF libraries altogether, which defeats the purpose of auditing them
None of these is acceptable for compliance reporting or for alerting on sensitive libraries. A simple indicator on the affected records would let us interpret the data correctly without changing our document formats.