OneDrive API编辑PPT文件时的活动类型、未返回FileModified操作的原因及API轮询检测文件变更的方法

Let's break down your questions clearly, based on real-world usage of the OneDrive and Office 365 APIs:

1. What activity types are returned for PPT file edits? #

When working with PPT files (and other Office documents) in OneDrive, the Audit.SharePoint feed from the Office 365 Management API typically returns these key activities related to edits:

• FileEdited: The primary event for content changes made via Office Online, desktop apps with co-authoring, or other Office-integrated tools. This tracks active editing sessions rather than just raw file changes.
• FileAccessed: Triggers when the PPT is opened (often precedes an edit action).
• FileSaved: May appear when a user explicitly saves changes, though this is sometimes rolled into the FileEdited event depending on the editing context.
• FileModified: Only shows up for changes made outside Office's native editing pipeline—like overwriting the file via upload, editing it with a non-Office tool, or syncing local edits that bypass co-authoring (filesystem-level modifications).

2. Why aren't you seeing the 'FileModified' operation for your PPT edits? #

The core reason is that your PPT edits are happening within the Office editing ecosystem. Microsoft distinguishes between two types of file change events:

• FileEdited: For content edits handled by Office's tools, where the platform tracks the edit session and collaborative actions instead of just a filesystem-level update.
• FileModified: For changes that alter the file's raw data or metadata outside of Office's edit workflow (e.g., uploading a new version, using a third-party editor, or syncing local changes that don't use co-authoring).

Also, double-check your tenant's audit settings in the Office 365 admin center—sometimes FileModified events might be disabled under Audit log settings.

3. Effective methods to detect OneDrive file changes #

Here are the most reliable approaches, ordered by efficiency:

a. OneDrive Delta API #

This is the gold standard for tracking file/folder changes, built specifically for sync scenarios. It returns all changes (creates, updates, deletes) since your last request, and you can store a deltaToken to resume tracking from where you left off.

• Example request for the root drive:

  GET /me/drive/root/delta
  

• For a specific folder:

  GET /me/drive/items/{folder-id}/delta
  

  This API gives you direct access to modified file details (like lastModifiedDateTime, file properties) without relying on audit logs.

b. Office 365 Management API (Audit Logs) #

If you need audit-level context (who made the change, when, what action), keep using this API—but adjust your filtering to look for FileEdited (for Office file edits) alongside FileModified. Note:

• Audit logs can have a 15-60 minute delay before events are available.
• Use the filter parameter to narrow results, e.g., filter=Operation eq 'FileEdited' or Operation eq 'FileModified'.

c. Webhooks (Push Notifications) #

Instead of polling, use OneDrive webhooks to get real-time push notifications when files/folders are modified. This eliminates unnecessary API calls and is ideal for reactive workflows.

• Subscribe to events like updated, created, or deleted for specific items or folders. When a change occurs, OneDrive sends a POST request to your configured endpoint with change details.

Bonus Tips #

• For the Delta API, handle @odata.nextLink (for pagination) and @odata.deltaLink (to save your sync state) properly.
• For audit logs, ensure your subscription includes all relevant event types by verifying settings in the Office 365 admin center.

内容的提问来源于stack exchange，提问作者shubhendu