SOLVED
Home

SOLVED: How to audit access from anonymous links?

%3CLINGO-SUB%20id%3D%22lingo-sub-378555%22%20slang%3D%22en-US%22%3ESOLVED%3A%20How%20to%20audit%20access%20from%20anonymous%20links%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-378555%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eis%20it%20possible%20to%20view%20which%20IP%20addresses%20have%20accessed%20a%20file%20through%20an%26nbsp%3Banonymous%20link%20distributed%20through%20OneDrive%20for%20Business%3F%20I%20can't%20find%20anything%20in%20the%20Security%20and%20Compliance%20Center%20%2F%20Audit%20log%20Search.%20Googled%20the%20hell%20out%20of%20it%20and%20found%20nothing%2C%20only%20information%20related%20to%20the%20creation%20on%20sharing%20links.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20tips%20would%20be%20appreciated.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDennis%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-378555%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Eanonymous%20links%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAudit%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOneDrive%20for%20Business%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-382507%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20audit%20access%20from%20anonymous%20links%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-382507%22%20slang%3D%22en-US%22%3E%3CP%3EBoth%20solutions%20were%20correct.%20I%20just%20didn't%20know%20what%20I%20was%20looking%20for%20in%20the%20compliance%20center.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20Security%20and%20Compliance%20Center%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F97134i933A05B4BC9D3A0A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22SecurityAndComplianceCenter.PNG%22%20title%3D%22SecurityAndComplianceCenter.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20in%20the%20Cloud%20App%20Security%20Portal%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F97135i382352D01CA9696E%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22CloudAppAndSecurityPortal.PNG%22%20title%3D%22CloudAppAndSecurityPortal.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20your%20help%20guys.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-380701%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20audit%20access%20from%20anonymous%20links%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-380701%22%20slang%3D%22en-US%22%3ETake%20also%20a%20look%20at%20the%20Audit%20Log%20Search%20feature%20in%20the%20Compliance%20Center%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-379004%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20audit%20access%20from%20anonymous%20links%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-379004%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Fwhat-is-cloud-app-security%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EMicrosoft%20Cloud%20App%20Security%3C%2FA%3E%2FOffice%20365%20Cloud%20App%20Security%20can%20probably%20do%20this%2C%20at%20a%20cost%2C%20other%26nbsp%3Bmembers%20may%20know%20if%20there%20is%20an%20easier%20way%20of%20doing%20this.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Factivity-filters%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Factivity-filters%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThere%20are%20various%20queries%26nbsp%3Bbuiltin%20that%20can%20highlight%20these%20events%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFile%20and%20folder%20activities%20-%20filters%20all%20your%20activities%20to%20display%20only%20those%20activities%20that%20involved%20files%20and%20folders.%20The%20filter%20includes%20upload%2C%20download%2C%20and%20accessing%20folders%2C%20along%20with%20creating%2C%20deleting%2C%20uploading%2C%20downloading%2C%20quarantining%2C%20and%20accessing%20files%2C%20and%20transferring%20content.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
dchandler
New Contributor

Hi,

 

is it possible to view which IP addresses have accessed a file through an anonymous link distributed through OneDrive for Business? I can't find anything in the Security and Compliance Center / Audit log Search. Googled the hell out of it and found nothing, only information related to the creation on sharing links.

 

Any tips would be appreciated.

 

Dennis

3 Replies

Microsoft Cloud App Security/Office 365 Cloud App Security can probably do this, at a cost, other members may know if there is an easier way of doing this. 

 

https://docs.microsoft.com/en-us/cloud-app-security/activity-filters

 

There are various queries builtin that can highlight these events:

 

File and folder activities - filters all your activities to display only those activities that involved files and folders. The filter includes upload, download, and accessing folders, along with creating, deleting, uploading, downloading, quarantining, and accessing files, and transferring content.

 

Solution
Take also a look at the Audit Log Search feature in the Compliance Center

Both solutions were correct. I just didn't know what I was looking for in the compliance center.

 

In Security and Compliance Center

SecurityAndComplianceCenter.PNG

 

And in the Cloud App Security Portal

CloudAppAndSecurityPortal.PNG

 

Thanks for your help guys.

Related Conversations
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
28 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
2 Replies
*Updated 9/3* Syncing in Microsoft Edge Preview Channels
Elliot Kirk in Articles on
202 Replies
Early preview of Microsoft Edge group policies
Sean Lyndersay in Discussions on
65 Replies