Step-by-Step Guide to Tracking OneDrive User Actions

You can monitor OneDrive activity by using audit logs and Microsoft 365 security tools. These tools help you detect unauthorized sharing, unusual access, and changes that could compromise your data. OneDrive continuously monitors activity in real-time and applies strict policies to prevent issues like data theft and insider threats. With Microsoft Purview and the Admin Center, you can effectively monitor OneDrive activity, see what users are doing, and respond quickly if something suspicious occurs. Stay vigilant and use these tools to keep your data secure.

Key Takeaways

• Turn on OneDrive audit logs with Microsoft Purview or PowerShell. This helps you track what users do and keeps your data safe.

• Make sure you have the right Microsoft 365 subscription and admin roles. These let you get to audit logs and manage them well.

• Check and filter audit logs often. Look for things like file sharing, editing, and strange access.

• Export audit data if you want to study it more. Set up alerts to find risky actions fast and act quickly.

• You can use third-party tools and automation. These help you watch better, keep data longer, and make following rules easier.

Prerequisites

Subscriptions Needed

You need a Microsoft 365 subscription to track user actions in OneDrive. OneDrive for Business comes with Microsoft 365 business plans and has audit log features. Regular OneDrive does not have these tools for monitoring. If you use Microsoft Purview for audit log search, you need a license like Microsoft 365 E5 or a similar plan. With an E5 license, you get advanced audit log retention and more monitoring. This means you can keep audit logs for up to 10 years. If you do not have an E5 subscription, you can still use audit logs, but you only keep them for 90 days. You can also try Microsoft Purview compliance solutions for 90 days if you do not have an E5 license.

Tip: Always look at your subscription details in the Microsoft 365 Admin Center to see if you can use audit log features.

Admin Roles

You need the right admin roles to turn on and view OneDrive audit logs. The Global Administrator role gives you the most access and lets you manage all audit log settings. If you want to give less access, use the 'View-Only Audit Logs' role. This role lets users look at and search audit logs but not change anything. You can also use the 'Audit Logs' role in Exchange Online to turn on audit logging. These roles let you get to audit logs through the Microsoft Purview Compliance Portal or PowerShell.

Environment Setup

Before you start tracking user actions, set up your environment the right way:

1. Give the Audit Logs role in Exchange Online. This role is in the Compliance Management and Organization Management groups.

2. Check if auditing is on by running this PowerShell command:

Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

1. If auditing is off, turn it on using the Microsoft Purview portal or PowerShell.

2. To turn on auditing in PowerShell, use:

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

1. Wait up to 60 minutes for changes to work.

2. For Small and Medium Business licenses or free trial tenants, auditing is not on by default. You need to turn it on yourself.

Note: Setting things up the right way helps you capture all needed user actions in your audit logs.

Enable Audit Logs

Microsoft Purview Portal

You can turn on audit logs for OneDrive in the Microsoft Purview Compliance portal. This portal helps you track what users do. Here are the steps to set up audit logging: 1. Open the Microsoft Purview Compliance portal and go to the Audit section. 2. If you see a banner that says "Start recording user and admin activity," click it to begin. 3. Choose the start and end dates for your audit log search. 4. In the Activities area, pick "Accessed file." 5. Use the Workloads filter and pick "OneDrive" to only see OneDrive actions. 6. Click the Search button to see audit logs for OneDrive file access. 7. Export the report if you want to look at the data more.

Note: Audit logs stay in the system for 180 days by default. If you want to keep logs longer, you need a Microsoft 365 E5 license or a special add-on.

PowerShell Method

You can also turn on audit logs with PowerShell. This way is good if you like using commands or want to automate things. Here is how you do it:

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

After you run this command, wait between 30 minutes and 24 hours for audit events to show up. You can check if it works by searching audit logs with PowerShell. Use these commands to connect and search:

Connect-ExchangeOnline -UserPrincipalName admin_username@contoso.onmicrosoft.com
Search-UnifiedAuditLog -StartDate "MM/DD/YYYY" -EndDate "MM/DD/YYYY"
Disconnect-ExchangeOnline -Confirm:$false

If you see an execution policy error, fix it with Set-ExecutionPolicy RemoteSigned before you connect.

Confirm Activation

Always check that audit logging is turned on. In the Purview portal, look at the Audit solution card. If auditing is off, a banner will tell you to start recording activity. When it is on, you can search for audit records in the Security & Compliance Center. You can also use PowerShell to check by searching for recent audit logs. Make sure you have the right permissions, like "View-Only Audit Logs" or "Audit Logs," to use these features.

Tip: After you turn on audit logs, wait up to 24 hours for new events to show up. Check often to make sure your OneDrive activity is being tracked.

Monitor OneDrive Activity

Watching what users do in OneDrive helps keep data safe. It also helps you find problems early. You can use Microsoft Purview, the Admin Center, or PowerShell to watch OneDrive activity. This part explains how to see audit logs, pick out important actions, and save the data for a closer look.

Access Audit Logs

There are different ways to see audit logs and check OneDrive activity. The most used ways are the Microsoft Purview portal, PowerShell, or the Microsoft 365 Admin Center.

To see OneDrive audit logs with Microsoft Purview:

1. Sign in to the Microsoft 365 Purview portal.

2. Go to the Audit section.

3. Pick the start and end dates for your search.

4. In Activities, choose actions like "Added site collection admin" or other OneDrive actions.

5. Pick "OneDrive" as the workload.

6. Click Search to see what happened.

7. Use Export to download the report as a CSV file.

You can also use PowerShell to check OneDrive activity:

1. Open the Exchange Online management shell.

2. Connect with Connect-ExchangeOnline.

3. Run the Search-UnifiedAuditLog command with filters for OneDrive events, like "SiteCollectionAdminAdded".

4. Look at the results to see who did what and which files or folders were changed.

If you want to see a certain user's OneDrive in the Admin Center:

1. Sign in to the Microsoft 365 Admin Center.

2. Go to Users > Active Users.

3. Pick the user.

4. Open the OneDrive tab.

5. Under "Get access to files," make a link to the user's files. Only global admins can use this link.

Tip: The Purview portal lets you search audit records by activity, user, and date. You can also export these records to look at them later.

Filter and Export Data

To watch OneDrive activity well, you need to filter audit logs for the most important actions. The audit log search tool in Microsoft Purview lets you filter by activity type, user, and date range. You can focus on file and folder actions, like viewing, editing, sharing, deleting, or moving files.

You can also use PowerShell scripts for searches you do often or want to automate. This helps you find and get the data you need fast. Since OneDrive uses SharePoint, you can use SharePoint audit filters and APIs for more details.

Common filters are:

• File and folder sharing actions (accessing, uploading, downloading, changing, deleting, moving, renaming, restoring, recycling)

• Sync actions (allowing or blocking sync, downloading or uploading changes)

• Sharing actions (accepting or denying access requests, making or deleting sharing links, changing permissions)

After you filter the logs, you can export them for more study. Export the results as a CSV file from the Purview portal or use PowerShell to save the output. You can open the CSV file in Microsoft Excel to sort, filter, and study the data. If you want to make dashboards or visual reports, import the CSV file into Power BI.

Note: Exported audit logs have details like activity time, type, file name, user, file URL, and site URL. This helps you watch OneDrive activity and spot patterns or risks.

Track File and Sharing Actions

When you watch OneDrive activity, focus on actions that matter most for safety and rules. Audit logs track many user actions, like:

• Viewing and editing files

• Sharing files with people inside or outside your group

• Deleting files or folders (even in the recycle bin)

• Changing, copying, moving, or renaming files

• Restoring files from the recycle bin

• Making or deleting sharing links

• Changing permission levels

• Removing sensitivity labels

Audit logs also show who did the action, their IP address, and device info. This helps you spot strange activity, like odd sign-ins, access from new places, or lots of file deletions.

Alert: Watch for signs of strange activity, like failed sign-ins, access from unknown IP addresses, or sudden jumps in file sharing. These could mean someone is trying to get your data without permission.

You can use tools like AdminDroid for more detailed reports and alerts. These tools help you watch OneDrive activity, track what users do, and protect your data with better filters and visual reports.

By following these steps, you can watch OneDrive activity, keep your data safe, and follow the rules. Check your audit logs often and set up alerts to catch problems early.

Advanced Tools and Best Practices

Third-Party Solutions

You can make OneDrive monitoring better by using third-party tools. These tools give you more features than Microsoft 365.

• Advanced metadata management helps you sort and find files fast.

• Comprehensive search lets you look through many file types.

• Workflow automation makes asset management easier.

• Strong access controls help you work safely with outside teams.

• Some tools keep audit logs as long as you want, not just for a short time.

• You can set up custom audit profiles to watch for certain actions, like unauthorized access.

• Export audit reports in formats like PDF, HTML, XLSX, or CSV.

• Schedule automatic reports for your team or other people.

Tip: Third-party tools help you get past Microsoft 365 limits, like short data retention and slow searches.

Automation and Alerts

You can set up alerts to spot risky actions in OneDrive. Microsoft Power Automate lets you make flows that send emails or Teams messages when certain file events happen. Third-party tools like AdminDroid, CoreView, and platforms like Zapier or Automate.io help you build more alert systems.

• Use these tools to trigger alerts for file downloads, sharing, or strange activity.

• Automate responses, like turning off accounts or logging incidents, to save time.

To make alerts work well:

1. Change alerts to fit your business needs and rules.

2. Use severity levels to focus on the most important alerts.

3. Set limits to stop too many false alarms.

4. Filter alerts for high-risk users or actions.

5. Check and update alert settings often.

Note: Automation cuts down on manual work and helps you act on threats faster.

Compliance Tips

You must watch OneDrive user actions to meet rules like HIPAA, ISO 27001, and SOC 2. Turn on audit logs, use multi-factor authentication, and limit sharing outside your group. Microsoft Purview helps you label and protect sensitive data with labels and data loss prevention policies.

• Make data classification and retention settings the same for everyone.

• Set clear time limits for keeping data.

• Automate data removal to follow rules.

• Keep good records of retention choices and actions.

• Review and change policies as rules change.

Callout: Regular training helps your team spot threats and follow the rules.

Troubleshooting

You might have problems when turning on or using audit logs. Sometimes, logs do not show up even if you have the right permissions.

• Try signing in again if you see errors after turning on the OneDrive container.

• Use Shift + Delete to remove folders that will not go away.

• Run the 'Check User Access' tool in the admin center for permission problems.

• Change user permissions by hand if needed.

• Remove and add users or guest accounts again if errors keep happening.

• Restore original usernames to fix user ID problems.

Native audit logs have limits, like event caps and slow searches. Use APIs or third-party tools for faster, deeper checks and longer log storage.

Alert: If you still have problems, contact Microsoft Purview support for help with audit log issues.

---

To watch what happens in OneDrive, start by turning on audit logging. Then, search and filter the logs by what people do. Look at important details and export the results if you want to study them more. Checking these logs often helps you find problems fast, follow rules, and lower risks. After that, set up alerts that work by themselves and check your audit rules often. If your group gets bigger, use better tools to help you watch more things. Always pay attention to keep your data safe and your group following the rules.

FAQ

How often should you check OneDrive audit logs?

Check audit logs at least once every week. If your group has sensitive data, check them every day. Looking at logs often helps you find strange activity fast.

Can you monitor shared files with external users?

Yes, you can see when users share files outside your group. Use the Microsoft Purview portal to filter logs for sharing actions. This lets you know who shared files and with whom.

What if audit logs do not show recent activity?

If you do not see new events, wait up to 24 hours. Logs sometimes need time to update. Make sure auditing is on and you have the right permissions.

Can you automate alerts for suspicious OneDrive actions?

You can set up alerts with Microsoft Power Automate or other tools. These alerts tell you about risky actions, like deleting many files or odd sharing.

How long does Microsoft keep OneDrive audit logs?

Microsoft keeps audit logs for 90 days with normal licenses. With a Microsoft 365 E5 license, you can keep logs for up to 10 years. Always check your subscription details.