SOLVED
Home

SOLVED: How to audit access from anonymous links?

%3CLINGO-SUB%20id%3D%22lingo-sub-378555%22%20slang%3D%22en-US%22%3ESOLVED%3A%20How%20to%20audit%20access%20from%20anonymous%20links%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-378555%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eis%20it%20possible%20to%20view%20which%20IP%20addresses%20have%20accessed%20a%20file%20through%20an%26nbsp%3Banonymous%20link%20distributed%20through%20OneDrive%20for%20Business%3F%20I%20can't%20find%20anything%20in%20the%20Security%20and%20Compliance%20Center%20%2F%20Audit%20log%20Search.%20Googled%20the%20hell%20out%20of%20it%20and%20found%20nothing%2C%20only%20information%20related%20to%20the%20creation%20on%20sharing%20links.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20tips%20would%20be%20appreciated.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDennis%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-378555%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Eanonymous%20links%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAudit%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOneDrive%20for%20Business%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-382507%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20audit%20access%20from%20anonymous%20links%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-382507%22%20slang%3D%22en-US%22%3E%3CP%3EBoth%20solutions%20were%20correct.%20I%20just%20didn't%20know%20what%20I%20was%20looking%20for%20in%20the%20compliance%20center.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20Security%20and%20Compliance%20Center%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F97134i933A05B4BC9D3A0A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22SecurityAndComplianceCenter.PNG%22%20title%3D%22SecurityAndComplianceCenter.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20in%20the%20Cloud%20App%20Security%20Portal%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F97135i382352D01CA9696E%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22CloudAppAndSecurityPortal.PNG%22%20title%3D%22CloudAppAndSecurityPortal.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20your%20help%20guys.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-380701%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20audit%20access%20from%20anonymous%20links%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-380701%22%20slang%3D%22en-US%22%3ETake%20also%20a%20look%20at%20the%20Audit%20Log%20Search%20feature%20in%20the%20Compliance%20Center%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-379004%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20audit%20access%20from%20anonymous%20links%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-379004%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Fwhat-is-cloud-app-security%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EMicrosoft%20Cloud%20App%20Security%3C%2FA%3E%2FOffice%20365%20Cloud%20App%20Security%20can%20probably%20do%20this%2C%20at%20a%20cost%2C%20other%26nbsp%3Bmembers%20may%20know%20if%20there%20is%20an%20easier%20way%20of%20doing%20this.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Factivity-filters%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Factivity-filters%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThere%20are%20various%20queries%26nbsp%3Bbuiltin%20that%20can%20highlight%20these%20events%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFile%20and%20folder%20activities%20-%20filters%20all%20your%20activities%20to%20display%20only%20those%20activities%20that%20involved%20files%20and%20folders.%20The%20filter%20includes%20upload%2C%20download%2C%20and%20accessing%20folders%2C%20along%20with%20creating%2C%20deleting%2C%20uploading%2C%20downloading%2C%20quarantining%2C%20and%20accessing%20files%2C%20and%20transferring%20content.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
dchandler
New Contributor

Hi,

 

is it possible to view which IP addresses have accessed a file through an anonymous link distributed through OneDrive for Business? I can't find anything in the Security and Compliance Center / Audit log Search. Googled the hell out of it and found nothing, only information related to the creation on sharing links.

 

Any tips would be appreciated.

 

Dennis

3 Replies

Microsoft Cloud App Security/Office 365 Cloud App Security can probably do this, at a cost, other members may know if there is an easier way of doing this. 

 

https://docs.microsoft.com/en-us/cloud-app-security/activity-filters

 

There are various queries builtin that can highlight these events:

 

File and folder activities - filters all your activities to display only those activities that involved files and folders. The filter includes upload, download, and accessing folders, along with creating, deleting, uploading, downloading, quarantining, and accessing files, and transferring content.

 

Solution
Take also a look at the Audit Log Search feature in the Compliance Center

Both solutions were correct. I just didn't know what I was looking for in the compliance center.

 

In Security and Compliance Center

SecurityAndComplianceCenter.PNG

 

And in the Cloud App Security Portal

CloudAppAndSecurityPortal.PNG

 

Thanks for your help guys.