How to query the Entra ID or M365 logs for external sharing to a specific domain?

EnterpriseArchitect 4,996 Reputation points
2024-01-22T04:34:39.5266667+00:00

Folks, How can I use the built-in Kusto QL or any methods for user activity that is sharing / inviting External users to the OneDrive or SharePoint sites? Thank you.

Azure Data Explorer
Azure Data Explorer
An Azure data analytics service for real-time analysis on large volumes of data streaming from sources including applications, websites, and internet of things devices.
501 questions
SharePoint
SharePoint
A group of Microsoft Products and technologies used for sharing and managing content, knowledge, and applications.
10,133 questions
OneDrive Management
OneDrive Management
OneDrive: A Microsoft file hosting and synchronization service.Management: The act or process of organizing, handling, directing or controlling something.
1,183 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,316 questions
0 comments
Accepted answer
  1. Emily Du-MSFT 43,421 Reputation points Microsoft Vendor
    2024-01-23T10:09:54.2433333+00:00

    OneDrive is personal storage for uses to store their files. By default, even if global administrator does not have permission for each user's OneDrive.

    There is a workaround to retrieve is the OneDrive sharing report for all users.

    1.Grant your account with admin permission for all users' OneDrive.

    https://www.sharepointdiary.com/2017/04/gain-admin-permission-to-onedrive-for-business-sites-using-powershell.html

    2.Run script in the following article.

    https://practical365.com/reporting-on-onedrive-for-business-shared-files/

    Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Emily Du-MSFT 43,421 Reputation points Microsoft Vendor
    2024-01-22T09:54:00.5166667+00:00

    1.For OneDrive, open OneDrive Online -> On the Settings menu, click OneDrive settings -> Click More settings, and then click Run sharing report -> Choose a location to save the report, and then click Save -> Click Run sharing report again, please click "You may see the results of this query here" link.

    1

    2.For SharePoint, there are three methods to get share report.

    (1)OOTB: Open the site collection -> On the Settings menu, click Site usage -> In the Shared with external users section, click Run report -> Choose a location to save the report, and then click Run report.

    (2)PowerShell:

    https://www.sharepointdiary.com/2017/11/sharepoint-online-find-all-external-users-using-powershell.html

    (3)Audit log: Go to Microsoft 365 admin center -> Security -> Audit -> New Search -> In the Activities, choose activities about sharing.

    2

    Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.