Office 365 Advent Calendar – 19 Auditing External Sharing in SharePoint Online

When it comes to sharing content with external parties in SharePoint Online, setting up sharing can be done easily. But what if you want to get some details on who shared which content with which external party, for example for compliance or audit reasons?

The good news is that this kind of information can be retrieved quite easily from Office 365, and you can even set up alerts to be notified about specific events!

To get started, head to the Security & Compliance portal at https://protection.office.com. On the left side, select ‘Search & investigation’ and click on ‘Audit log search’:

Note: To search the audit logs, you first need to enable recording activities. You can’t retrieve information about events that happened before you turned this on. On the ‘Audit log search’ page, click on ‘Start recording user and admin activities’:

Once that’s done, you can then use the search to retrieve details on specified activities. You can narrow down the activities you’re interested in (there’s a large range of activities you can retrieve, not just on external sharing), the time frame, as well as the users involved:

For the activities, the activities related to external sharing can be found under ‘Sharing and access request activities’:

Interesting here are: ‘Created sharing invitation’, ‘Withdrew sharing invitation’, ‘Used an anonymous link’, ‘Updated an anonymous link’,  ‘Accepted sharing invitation’, ‘Created an anonymous link’, and ‘Removed an anonymous link’.

Once you’ve defined your search parameters, you can either kick off the Search or you can Add an alert:

My demo search found 4 results:

You can then apply additional filters, export all details to Excel, or review an individual entry:

And what happens when you set an alert? Shortly after an activity that you want to get notified about has been recorded, you’ll received an email similar to this: