Forum Discussion
Auditing email alerts
We share files via sharepoint online with external and internal users. We also setup alerts on the document libraries for things like when files are shared with the users. The alert is sent out via this email address - "email address removed for privacy reasons". Our users would like to audit when the email was sent to the external user notifying them that the file was shared with them. As far as I know, there is nothing logged in the audit logs for when the email was sent to the external user notifying them that our user has shared a file with them. We dont have this issue with internal users as we can track the emails coming into our EXO via message tracking logs. Is there a way to track or audit the emails sent to the external users ?
Regards
Jason
3 Replies
We've hit the same limitation. One workaround is enabling Unified Audit Logs and looking for "SharingSet" operations in the logs.5CKEt5uceZR3D6ADFDF69ACDF627F4D9EAC74E33D72E36F6F54FE357D6269F349722AE4DB6B042FEE5D4A4695E0110F6A042A72DF2B92E4E3186FyiCajlEiwDIt doesn't show email delivery, but at least shows when a share was initiated.You might try setting up a DLP policy or Defender alert that triggers when content is shared externally — not a perfect solution, but it could help trace activity even if email delivery isn’t directly logged.
We've hit the same limitation. One workaround is enabling Unified Audit Logs and looking for "SharingSet" operations in the logs.5CKEt5uceZR3D6ADFDF69ACDF627F4D9EAC74E33D72E36F6F54FE357D6269F349722AE4DB6B042FEE5D4A4695E0110F6A042A72DF2B92E4E3186FyiCajlEiwDIt doesn't show email delivery, but at least shows when a share was initiated.
MS support said no this cannot be tracked.
Thanks
