Can version history show who changed a file?¶
Version history may identify the account, application or process that the provider associated with a change. That is useful attribution evidence, but it does not automatically identify the person behind the recorded actor.
Read the version entry literally¶
A useful entry may contain an object ID, version ID, timestamp, recorded editor and details of the changed content. First establish exactly what the provider asserts:
object_id=OBJ-4407
version_id=V-19
recorded_actor=C-77503
client=web-editor
saved_at=2026-08-12T14:22:08Z
This associates account C-77503 and the web editor with the save. It does not show a face at the keyboard.
Identify how the version was created¶
Autosave may group several small edits. Collaborative tools may merge changes from several accounts. An upload, import, format conversion, synchronisation client or authorised application can also create a version without a person typing at the recorded time.
Provider detail varies. Character-level revision attribution is stronger for a particular passage than a periodic snapshot labelled with the last active account.
Build the bridge to a person¶
Compare the version entry with the account session, client or device identifier, authentication events, application records and local activity. Communications or work records may corroborate why that person made the particular change.
Shared, delegated or compromised access remains a specific alternative to test. File-version history may also be incomplete because of retention or provider grouping.
Dave edits paragraph 12 in Word for the web. OneDrive records object OBJ-4407, version V-19, account C-77503 and the web editor at 14:22. The version entry establishes the provider's actor and process for that checkpoint. An active Microsoft 365 session SES-41C2, Surface browser records and a Teams message discussing the wording provide the next bridges to Dave; whether autosave grouped Priya's earlier suggestion remains a separate question.
V-19, and joined records can place that session on Dave's Surface.The next useful comparison is the precise version difference and revision attribution against the session, browser or editor records, suggestion history and communications about the changed content.
Current Microsoft version-actor example - checked 3 September 2026
Microsoft Graph currently represents a retained file state as a driveItemVersion. Its documented fields include the version ID, lastModifiedBy, lastModifiedDateTime and size. Those fields identify the actor and time at the service's version level; they do not by themselves establish personal authorship of every change grouped into that version.
The point to remember
Version history can provide strong account- and process-level attribution. Personal authorship requires the session, device and context connecting that recorded actor to the relevant change.
