Skip to main content
User Activity reports provide an overview of the actions your users are taking in Box. Use this report to view the actions made by your users within a given time period. You can filter the report by:
  • Groups or managed users
  • Specific folders or files
  • Action types (events)
If you choose to export this report, a new folder will be created in your Box Reports folder containing a .csv file. This folder description in the right-hand sidebar will contain information about your report. It may take some time for the .csv file to appear. While your report is exporting, the Status field in the folder description will read In Progress. Once your report has been exported, the status changes to Complete. You must define filters for the User Activity report before you can run it.

​
User Activity report details

  • File format: comma-separated value (.csv) file
  • Filename format: user_activity_run_on_YYYY-MM-DD-HH-MM-SS_Page_#.csv
  • Folder name format (each report run is placed in its own folder):User Activity run on YYYY-MM-DD HH-MM-SS
  • Filename and folder name time zone: the local date and time of the admin who ran the report or who set up the report schedule.
Notes:
  • At least one Action Type must be selected to run a User Activity report.
  • When unmanaged users are converted to managed status, some pre-conversion activity relating to their user account is included in the report.
  • Actions taken by External Users will be included within a User Activity Report if the report is run on the entire Enterprise.
  • If the date range is within last year, it is usually faster to run the report in Box rather than exporting it.
  • If your date range is greater than 1 year, you must export the report. The run button will be disabled.
  • User actions may be delayed by up to one day before uploading an exported .csv reports.
  • A “user” with the name “Box Admin Reports” appears as a newly-created user the first time an admin runs a report.
  • You cannot filter by a deleted user prior to running or exporting the report.
  • Filtering for a folder displays activity for files and folders immediately within it, but not activity for content within subfolders.
  • For the View report, events only within the last year are available.

​
User Activity report data columns

This section describes the data columns that are generated in User Activity reports. You can select which data columns appear in the report. All columns are selected by default, and the columns marked with an asterisk are required. Date* Required. The date and time, in the local time of the admin who ran the report or who set up the report schedule, of the action. User Name* Required. The name of the user, from the value in the Name field in User Account Details. User Email The email address of the user, from the value in the Email field in User Account Details. User ID The value in the User ID field in the user’s User Account Details, for external and managed users. IP Address The IP address of the computer or device from which the action was initiated. Box reports “Unknown IP” in the User Activity report when you:
  • Spoof an IP address
  • Use a VPN proxy
  • Use Box’s internal IP address
Action* Required. The action, or event. The Action Types section below lists all possible values. Affected* Required. The value in this field depends on the type of user action taken. User actions are divided into two types: item events and collaboration events.
  • Item events are generated when users act on a file (for example, move, copy, preview, or download). The value is the file or folder acted on.
  • Collaboration events are generated when files or folders are shared. The value is the email address or user ID of the collaborator.
Affected ID The unique number that identifies the file or folder on which the action was taken. Size (kB) The size in kilobytes of the file or folder on which the action was taken. Parent Folder The path to the file or folder on which the action was taken from the root of your Box instance. Details* Required. If there are any additional details to report on the user action, they are included here. This includes:
  • Any exception justification the user entered when attempting to permanently deleting files.
  • The outcome of the attempted deletion which took place under a retention exception. The Details column displays whether deletion was successful:
    • Content deletion failed – The content was not deleted due to another non-modifiable retention or legal hold.
    • Content deletion succeeded – The content was successfully deleted.
Classification Available only for customers who use Box Shield. Shows the classification label, if any, of the file or folder on which the action was taken.

​
User Activity report filters

​
User Activity report action types

User Activity reports contain data about actions, sometimes described as events, your users take in Box. The Action Types section is where you select which user actions you want to include in the User Activity report. Select the check box for:
  • Select All to include all user activities
  • An Action Type category to select all of the user activities in that type
  • Any individual user activity
At least one Action Type must be selected to run a User Activity report.