How to Track Down Rapid SharePoint Folder Growth: A Troubleshooting Guide

Rapid, unexpected growth in SharePoint storage (for example, 100 GB in 48 hours) is a sign of unusual activity. This guide provides a structured, Microsoft Learn–style approach to identifying the root cause, whether you are using SharePoint Online or SharePoint Server on-premises (2016, 2019, or Subscription Edition).

Understanding the problem

When storage usage spikes, the immediate questions are:

Which site or folder is consuming the new space?
Which user or process uploaded, copied, or synchronized the data?
Is the growth legitimate (e.g., a planned migration) or abnormal (e.g., a rogue sync client or automated script)?

You will need a combination of built‑in reports, audit logs, and administrative tools to answer these questions.

Step 1 – Identify the affected site collection

Start with a high‑level view to pinpoint which site or site collection is growing.

Using the Microsoft 365 admin center (SharePoint Online)

Go to Microsoft 365 admin center > Reports > Usage.
Select SharePoint.
Examine the Site usage report for:

File count and active files trend.
Storage used per site.
Activity by user (uploads, downloads, syncs).

Note – These reports may have up to 48 hours of latency. For near‑real‑time investigations, use the audit log (Step 2).

Using PowerShell (SharePoint Online)

Run the following commands to list all sites sorted by current storage usage:

# Connect to SharePoint Online
Connect-SPOService -Url https://yourtenant-admin.sharepoint.com

# Get top 10 largest sites by storage usage
Get-SPOSite | Select DisplayName, StorageUsageCurrent, StorageQuota | 
    Sort StorageUsageCurrent -Descending | 
    Select -First 10

For on‑premises deployments

Open Central Administration > Application Management > View all site collections.
Look for site collections where Storage Used is unusually high or increasing rapidly.
Alternatively, use the on‑prem version of PowerShell:

Get-SPSite -Limit All | Select Url, @{Name="StorageMB";Expression={$_.Usage.Storage/1MB}} | 
    Sort StorageMB -Descending | Select -First 10

Step 2 – Drill into libraries, folders, and files

Once you have identified the problematic site, examine its internal structure.

Storage Metrics page (SharePoint on‑premises)

Go to the site’s Site Settings.
Click Storage Metrics (under Site Collection Administration).
Expand the tree view to see storage consumption per:

Subsite
Document library
Folder
Individual file (including version size)

Using PnP PowerShell (Online and on‑prem)

The following script returns storage metrics for every folder in a document library:

# Connect with PnP PowerShell
Connect-PnPOnline -Url https://yourtenant.sharepoint.com/sites/problemSite

# Get folder storage metrics
Get-PnPFolder -List "Documents" -Includes StorageMetrics | 
    Select Name, StorageMetrics

Step 3 – Pinpoint the responsible user and action

This is the most critical step. You need to know who did what, when, and from where.

Using the Microsoft Purview audit log (SharePoint Online)

The unified audit log records every file upload, copy, sync, and download.

Go to Microsoft Purview compliance portal > Audit.
Click Search.
Set the Date range (focus on the growth period).
Under Activities, select the relevant SharePoint file activities:

FileUploaded
FileCopied
FileSyncDownloadedFull (indicates OneDrive sync of a large number of files)
FileAccessed (can reveal abnormal access patterns)

Filter by user if you suspect a specific account.
Add filters for site URL, file extension, or client IP address.

The results show each activity with the user principal name, file name, and time stamp.

Tip – If you see repeated FileSyncDownloadedFull events from the same user, they may have enabled offline sync on a library containing many large files.

Using on‑premises audit log reports

In Central Administration, configure Audit settings for the web application (enable auditing of Editing items, Checking out / in, Moving or copying items).
After the audit data is collected, go to the site collection’s Site settings > Site collection audit settings > Audit log reports.
Generate a Content activity report for the relevant date range.

Real‑time monitoring with ClientServiceActionUsage logs

If the growth is actively happening, use PowerShell to inspect the ClientServiceActionUsage log entries (SharePoint Online):

Search-UnifiedAuditLog -StartDate (Get-Date).AddHours(-24) -EndDate (Get-Date) `
    -Operations "ClientServiceActionUsage" | 
    Select -First 50 | 
    Format-List UserIds, AuditData

Look for repeated calls that upload or copy large amounts of data.

Step 4 – Immediate mitigation actions

While investigating, you may need to stop the growth to prevent further impact.

Suspend the offending user account (if the activity is clearly abnormal) using the Microsoft 365 admin center or Active Directory.
Limit the OneDrive sync scope via Group Policy: set the Maximum download file size for OneDrive policy to a small value (e.g., 10 MB) to block large file syncs.
Restrict access to the folder or library – break permission inheritance and remove the suspect user’s write permissions.
Enable alerts for future spikes – create an alert policy in Microsoft 365 for FileUploaded events exceeding a high threshold (e.g., 10 GB in 1 hour).

Step 5 – Proactive prevention

After resolving the immediate issue, implement long‑term controls.

Prevention measure	Benefit	Where to configure
Storage quotas	Prevents a single site from consuming unlimited space.	SharePoint admin center (Online) or quota templates (on‑prem).
Audit retention policy	Ensures audit logs are kept long enough to investigate past spikes.	Purview compliance portal (Online) / Central Administration (on‑prem).
Alert policies	Notifies admins when upload rates exceed a normal baseline.	Microsoft 365 Defender / Purview alerts.
Version history limits	Stops storage bloat from excessive file versions.	Library settings > Versioning settings.
Access reviews	Removes orphaned or shared credentials that could be misused.	Microsoft Entra ID (Online) / custom scripts (on‑prem).

Monitoring automation (SharePoint Online)

Schedule a PowerShell script to run daily and export site storage changes:

# Example: Export storage usage for all sites
$allSites = Get-SPOSite -Limit All
$allSites | Select DisplayName, StorageUsageCurrent, StorageQuota, LastContentModifiedDate |
    Export-Csv -Path "DailyStorageReport_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

Comparison of investigation tools

Tool / Method	Environment	Granularity	Latency	Ease of use
Microsoft Purview audit log	SPO	File‑level activity	30‑60 mins	Medium
M365 admin center usage reports	SPO	Site‑level storage	Up to 48 hrs	Easy
SharePoint Online Management Shell	SPO	Site / library / folder	Real‑time (quota data)	Advanced
PnP PowerShell	SPO + on‑prem	Folder / file storage	Real‑time	Advanced
SharePoint on‑prem Storage Metrics	On‑prem	Folder / file details	Real‑time	Easy
Third‑party tools (ShareGate, Syskit, ManageEngine)	Both	Dashboard + automation	Real‑time	Easy – Medium

Summary

When facing rapid SharePoint folder growth:

Identify the site using admin reports or PowerShell.
Drill into folders using Storage Metrics or PnP PowerShell.
Find the user and action with audit logs (Purview for Online, on‑prem audit reports for Server).
Mitigate by suspending the user, limiting sync, or adjusting permissions.
Prevent recurrence with quotas, alerts, and automated monitoring.

By following this structured approach, you can quickly isolate the source of abnormal growth and take corrective action before it impacts your organization’s storage limits or performance.

Additional resources

X Facebook LinkedIn Copy Email Pinterest Reddit Telegram ChatGPT SMS