Discrepancies Between Web.LastItemModifiedDate and Last Activity column in SharePoint Admin Center

unknown_25 21

We use the Web.LastItemModifiedDate property of a site to identify recently modified sites. However, in some cases, the value of this property does not align with the Last Activity column in the SharePoint Admin Center. Could you clarify the factors that determine the Last Activity column in the Admin Center and those that influence the Web.LastItemModifiedDate property?

Additionally, we encountered a scenario where no audit events were triggered for a specific site, yet the Web.LastItemModifiedDate property was updated. This suggests the site was recently modified, but no corresponding audit events were logged in the SharePoint Purview portal. Could someone explain what actions or factors might cause the Web.LastItemModifiedDate property to change? Furthermore, could you provide a list of audit events that are triggered when this property is updated?

Thank you in advance for your assistance!

2 answers

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more
RaytheonXie_MSFT 37,076 Reputation points Microsoft Vendor

2024-12-23T02:43:07.2866667+00:00

Hi @unknown_25,

Graph API (MS Graph site object with "LastModifiedDateTime" property) is same with Last Activity in the Admin Center. This properties gets data from "Last activity” field via Admin Center GUI. The reports typically become available within 48 hours, but might sometimes take several days to become available. Here is the document for reference

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/activity-reports?view=o365-worldwide

And Web.LastItemModifiedDate is similar with Last Activity in the Admin Center. The only difference is Web.LastItemModifiedDate won't triggle when update m365 group membership via Teams by user.

Here is the difference between LastItemModifiedDate and Graph Last Modified DateTime

https://vladilen.com/software/sharepoint/spo-site-lastcontentmodifieddate-vs-lastitemmodifieddate-vs-lastitemusermodifieddate/

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
unknown_25 21 Reputation points

2024-12-23T06:13:55.1633333+00:00

Hi , Thanks for your reply.

We now understand the differences between the Web.LastItemModifiedDate and Graph Last Modified DateTime properties. However, we noticed a case where the Web.LastItemModifiedDate property was updated, but no audit events were logged in the SharePoint Purview portal. Could you explain why this happens? Also, please provide a list of audit events triggered when this property is updated if possible.

RaytheonXie_MSFT 37,076 Reputation points Microsoft Vendor

2024-12-23T07:44:29.3066667+00:00

Hi @unknown_25,

Per my research, SharePoint Purview portal will not be triggered when user just visited site. You could refer to following document

https://learn.microsoft.com/en-us/purview/audit-log-activities

RaytheonXie_MSFT 37,076 Reputation points Microsoft Vendor

2024-12-24T05:37:10.33+00:00

Hi @unknown_25,

Would you tell me whether your issue has been resolved or have any update? If you have any questions or progress, you can contact me in time.

unknown_25 21 Reputation points

2024-12-24T06:54:50.0666667+00:00

Hi @RaytheonXie_MSFT ,Thanks for the reply.

I ran a script, and it showed that the LastItemModifiedDate was updated at 5:36:59 AM for a file upload operation.

Afterward, I tested by visiting a site and also by viewing a file, but the Web.LastItemModifiedDate property did not change, still shows as 12/24/2024 5:36:59 AM. However, the audit events were triggered. Below is the screenshot of the audit events for the demotest123 site in the Microsoft Purview portal.

Additionally, I verified that the Last Activity column or Report Refresh Date is not the same as the Web.LastItemModifiedDate property. Below is the report generated by running the '/v1.0/reports/getSharePointSiteUsageDetails' API to retrieve these details.

RaytheonXie_MSFT 37,076 Reputation points Microsoft Vendor

2024-12-24T09:48:17.0066667+00:00

Hi @unknown_25,

Thanks for your time in advance, after doing some research, I found the third part article is incorrect. As the offical document mentioned, The Web.LastItemModifiedDate should only triggered with an item was modified but not visited. Here is the document

https://learn.microsoft.com/en-us/previous-versions/office/sharepoint-csom/ee539926(v=office.15)

And as the document in Audit log, if you viewed the file, the log will be triggered and the FileAccessed event will not be logged again for the same user for same file for the next five minutes. Here is the document for details

https://learn.microsoft.com/en-us/purview/audit-log-activities#file-and-page-activities
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.