Forum Discussion
Acessos pastas SharePoint / SharePoint folder access
É possível identificar somente acessos a pastas do SharePoint? Algumas informações internas da companhia foram vazadas e precisamos saber quem acessou a pastas do Sharepoint onde estavam essas informações. Outra situação, é que conseguimos identificar que nessa mesma pasta alguns arquivos foram baixados, mas no relatório o usuário aparece "app@sharepoint". Alguém saberia explicar?
It is possible to identify access to SharePoint folders? Some of the company's international information was leaked, and we need to know who accessed the SharePoint folders containing that data. Another issue is that we identified files being downloaded from that same folder, but the user appears as "app@sharepoint". Could anyone explain this?
1 Reply
Use Microsoft Purview Audit to investigate the files in that SharePoint folder, but treat this as file activity rather than a definitive “folder opened” report. Search the incident window for FileAccessed and FileDownloaded, then filter or export by SiteUrl, SourceRelativeUrl, SourceFileName, and ObjectId. Preserve UserId, ClientIP, UserAgent, ApplicationDisplayName, and EventData for correlation.
The value app@sharepoint is not a normal employee account. Microsoft documents it as an application presenting SharePoint App-Only authentication, sometimes for Microsoft 365 or compliance services acting on behalf of a user, administrator, or service. That field alone therefore cannot identify the person who caused the action. Check ApplicationDisplayName and EventData, then compare nearby audit events, Entra sign-ins, sharing events, and app permissions.
Because this concerns leaked information, preserve exported audit data before changing access, restrict affected sharing, and involve your security and legal response process. Avoid attributing a download until the records correlate.
