Forum Discussion
"Used secure link" O365 audit log activity
I'm not sure if this is already rolled out, but there will be email notifications upon opening the document for a first time, so that's one way to audit it. If the file was shared with an internal user, or external user with AAD account, you should still see the relevant "accessed file" entries in the Audit log.
VasilMichev, correct....From everything I read, the two action registrations in the audit log that were in my original post will be triggered when a recipient uses a link. But I can't get from the Microsoft documentation what level of data goes along with these events in the log. So I would need to know that one of those two "link used" actions was triggered, but also who did it and when. It's not clear to me how to get the "who did it, and when" part of it from the logs.
The trouble with the "who" part is that this might be an anonymous link, or one not tied in to any Azure AD user object, thus there might not be a way for O365 to report who accessed the file. TBH, I haven't actually bothered to check what's audited in such scenario, I'm just thinking aloud here. But since it's fairly easy to test, I'll give it a go and see what I can dig out.
VasilMichev, thanks for any additional information that you can provide after testing. I appreciate your effort! As an additional piece of information, the use-case for needing this type of information could be something such as litigation around a certain topic related to documents that were shared within the company. It sometimes becomes important to know not only what was shared and with whom, but whether or not they actually accessed that shared content.
