Forum Discussion

mx129's avatar
mx129
Copper Contributor
May 19, 2023

Audit for Sharing

What is the best way to search JUST for people who have shared files, links, etc.? Also, is there a job that can be run to perform this daily? We're small (100 users) so we're not talking a ton of data.

Thank you in advance

1 Reply

  • IsmKay's avatar
    IsmKay
    Copper Contributor
    May 23, 2023

    Hi mx129,

     

    there is multiple options to achieve what you asked for. I would recommend that you start with looking at Audit Logs. The Audit log contains events from Exchange Online, SharePoint Online, OneDrive for Business, Azure Active Directory, Microsoft Teams, Power BI, and other Microsoft 365 services. 
    https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-solutions-overview?view=o365-worldwide 

    However, under OfficeActivity logs you can find, among other things, the information about what is shared with whom “SharingType” & “UserSharedWith”.
    https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-log-search?view=o365-worldwide#audited-activities 
    Properties of audit logs entries are documented on Microsoft doc site https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-log-detailed-properties?view=o365-worldwide

     

    • If you are looking for automating the extraction of such logs you can use PowerShell script using Search-UnifiedAuditLog cmdlet and extract the data into a CSV file
      https://github.com/microsoft/Microsft-Purview-Advanced-Rich-Reports-MPARR-Collector 

     

    • Or for this small number of user you can automate using Logic Apps (or Azure Functions) to extract the logs via Office Management API.

     

    • You can also make use of Microsoft Defender for Cloud Apps and create a file policy to monitor files being shared with e.g., external domains.
      https://learn.microsoft.com/en-us/defender-cloud-apps/data-protection-policies

     

    • If you are looking to control who is able to share content with whom, then Microsoft Purview DLP is your way to go to. There you can monitor, and even take actions based on specific conditions you specify.

     

    Thank you and kind regards