SOLVED

OneDrive for Business auditing

%3CLINGO-SUB%20id%3D%22lingo-sub-310291%22%20slang%3D%22en-US%22%3EOneDrive%20for%20Business%20auditing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-310291%22%20slang%3D%22en-US%22%3E%3CP%3EDoes%20Office365%20E5%20log%20when%20files%2Ffolders%20from%20OneDrive%20for%20Business%20for%20a%20user%20are%20dragged%20and%20dropped%20to%20an%20external%20site%20like%20Dropbox%2C%20etc.%3F%20Or%20does%20it%20only%20log%20when%20files%2Ffolders%20are%20moved%20in%20the%20OneDrive%2FSharePoint%20tenant%3F%20I%20see%20there%20are%20properties%20such%20as%20File%2FFolderMoved%2C%20DestinationRelativeURL%2C%20etc.%2C%20but%20not%20sure%20if%20it%20would%20necessarily%20track%20the%20information%20of%20moving%20files%20to%20another%20cloud%20file%20server.%20Would%20it%20track%20any%20copy%20or%20move%20activities%3F%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3CP%3EFor%20example%2C%20if%20I%20had%20a%20tenant%20user%20drag%2Fdrop%20their%20OneDrive%20folders%2Ffiles%20from%20the%20OneDrive%20Windows%20client%20to%20Dropbox%2C%20etc.%20web-based%20client%2C%20would%20there%20be%20logging%20to%20show%20this%20occurred%3F%20Would%20there%20be%20any%20other%20logging%20that%20may%20demonstrate%20that%20these%20folders%2Ffiles%20did%20leave%20the%20OneDrive%2FSharePoint%20tenant%20or%20is%20that%20something%20that%20is%20too%20detailed%2Fcomplex%20to%20log%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-310291%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECompliance%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOneDrive%20for%20Business%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-310388%22%20slang%3D%22en-US%22%3ERe%3A%20OneDrive%20for%20Business%20auditing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-310388%22%20slang%3D%22en-US%22%3EStill%20holds%20true%20because%20the%20OS%20would%20download%20or%20already%20has%20the%20files%20synced%20locally%20and%20handle%20the%20transfer%2C%20so%20you%20are%20really%20just%20doing%20a%20file%20copy%20from%20your%20Hard%20Disk%20to%20Dropbox.%20So%20in%20this%20case%20nothing%20might%20show.%20If%20anything%20if%20Files%20On%20Demand%20is%20used%2C%20the%20download%20%2F%20sync%20of%20the%20files%20might%20show%20up%20in%20the%20log%20but%20that%20would%20be%20it.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-310382%22%20slang%3D%22en-US%22%3ERe%3A%20OneDrive%20for%20Business%20auditing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-310382%22%20slang%3D%22en-US%22%3E%3CP%3EThank%20you%2C%20Chris.%20Just%20to%20confirm%2C%20it%20was%20drag%20and%20drop%20straight%20from%20the%20OneDrive%20client%20located%20on%20a%20domain%20computer%20to%20Dropbox%20via%20web%20(no%20client).%20Nothing%20was%20downloaded%20to%20the%20local%20machine%20to%20do%20the%20transfer.%20The%20Dropbox%20web%20version%20allows%20for%20drag%20and%20drop%20functionality.%20Does%20that%20change%20anything%20or%20would%20the%20same%20hold%20true%20as%20you%20mentioned%20before%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-310358%22%20slang%3D%22en-US%22%3ERe%3A%20OneDrive%20for%20Business%20auditing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-310358%22%20slang%3D%22en-US%22%3EIt%20really%20can't%20unless%20there%20is%20something%20on%20the%20client%20side%20since%20the%20client%20usually%20mac%20or%20windows%2010%2C%20is%20basically%20downloading%20and%20uploading%20files%20from%20one%20to%20their%20other%20since%20OneDrive%20isn't%20doing%20the%20copy%20for%20you.%20%3CBR%20%2F%3E%3CBR%20%2F%3EWhat%20you%20might%20be%20able%20to%20see%20in%20a%20Log%20would%20be%20a%20large%20spike%20in%20file%20access%20or%20downloads%20showing%20a%20bunch%20of%20download%20activity%20for%20a%20user%2C%20but%20even%20that%20could%20just%20be%20the%20user%20downloading%20files%2C%20but%20usually%20a%20user%20wouldn't%20%2F%20shouldn't%20do%20it%20that%20way.%20But%20something%20along%20those%20lines%20would%20be%20your%20only%20option%20that%20I%20could%20think%20of%20outside%20of%20Firewall%20monitoring%20etc.%20If%20they%20are%20internal%20network%20etc.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-310331%22%20slang%3D%22en-US%22%3ERe%3A%20OneDrive%20for%20Business%20auditing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-310331%22%20slang%3D%22en-US%22%3ECurrently%20no%20and%20I%20have%20not%20heard%20this%20is%20something%20that%20it's%20going%20to%20happen%20in%20the%20near%20future%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Does Office365 E5 log when files/folders from OneDrive for Business for a user are dragged and dropped to an external site like Dropbox, etc.? Or does it only log when files/folders are moved in the OneDrive/SharePoint tenant? I see there are properties such as File/FolderMoved, DestinationRelativeURL, etc., but not sure if it would necessarily track the information of moving files to another cloud file server. Would it track any copy or move activities? 

For example, if I had a tenant user drag/drop their OneDrive folders/files from the OneDrive Windows client to Dropbox, etc. web-based client, would there be logging to show this occurred? Would there be any other logging that may demonstrate that these folders/files did leave the OneDrive/SharePoint tenant or is that something that is too detailed/complex to log? 

4 Replies
Highlighted
Currently no and I have not heard this is something that it's going to happen in the near future
Highlighted
It really can't unless there is something on the client side since the client usually mac or windows 10, is basically downloading and uploading files from one to their other since OneDrive isn't doing the copy for you.

What you might be able to see in a Log would be a large spike in file access or downloads showing a bunch of download activity for a user, but even that could just be the user downloading files, but usually a user wouldn't / shouldn't do it that way. But something along those lines would be your only option that I could think of outside of Firewall monitoring etc. If they are internal network etc.
Highlighted

Thank you, Chris. Just to confirm, it was drag and drop straight from the OneDrive client located on a domain computer to Dropbox via web (no client). Nothing was downloaded to the local machine to do the transfer. The Dropbox web version allows for drag and drop functionality. Does that change anything or would the same hold true as you mentioned before? 

Highlighted
Best Response confirmed by sakic19 (New Contributor)
Solution
Still holds true because the OS would download or already has the files synced locally and handle the transfer, so you are really just doing a file copy from your Hard Disk to Dropbox. So in this case nothing might show. If anything if Files On Demand is used, the download / sync of the files might show up in the log but that would be it.