SharePoint Audit Policy: Security Change

This audit flag corresponds to the "Editing users and permissions" check box on the "Site collection audit settings" page in Site Collection Administration.

These events document access control related changes to groups, permissions and site collection administrators.

Audit Flag	Event ID by LOGbinder for SharePoint
SecurityChange	11 - Site collection audit policy changed
	12 - Audit policy changed
	20 - Audit logs deleted
	25 - SharePoint group created
	26 - SharePoint group deleted
	27 - SharePoint group member added
	28 - SharePoint group member deleted
	29 - Unique permissions created
	30 - Unique permissions removed
	31 - Permissions updated
	32 - Permissions removed
	33 - Unique permission levels created
	34 - Permission level created
	35 - Permission level deleted
	36 - Permission level modified
	37 - SharePoint site collection administrator added
	38 - SharePoint site collection administrator removed

Upcoming Webinars

Anatomy of an Attack: Polymorphic vs Metamorphic Malware
File Security in Microsoft 365: Under Teams, OneDrive for Business, Microsoft 365 Groups it’s SharePoint
Understanding Broken Object Level Authorization: The Quiet Access Control Failure Undermining Today’s Apps

Additional Resources

Audit Policy

•	Check In/Out
•	Custom
•	View
•	Delete
•	Update
•	Security Change
•	Copy/Move
•	Search
•	Workflow
•	Profile/Schema Change

User name:
Password:
	/ Forgot?
	Register

January 2026 Patch Tuesday	"Patch Tuesday - Starting 2026 with a Bang; 3 Zero Days " - sponsored by LOGbinder and Supercharger

Follow @randyfsmith

About | Newsletter | Contact

Ultimate IT Security is a division of Monterey Technology Group, Inc. ©2006-2026 Monterey Technology Group, Inc. All rights reserved.
Disclaimer: We do our best to provide quality information and expert commentary but use all information at your own risk. For complaints, please contact abuse@ultimatewindowssecurity.com.