Track and Monitor Onedrive Activity in Microsoft 365

Tracking activity on OneDrive is a crucial aspect of maintaining data security and compliance in Microsoft 365. OneDrive activity can be tracked using the Activity page.

The Activity page provides a detailed log of all actions performed on OneDrive, including file uploads, downloads, and edits. This information can be used to identify potential security threats or data breaches.

To access the Activity page, navigate to the OneDrive settings and click on the "Activity" tab. From there, you can view a list of all recent activities, filtered by date and user.

To track activity on OneDrive, you can use the AuditFileActivities.ps1 script. This script allows you to monitor file activities in SharePoint Online and OneDrive.

You can track file activities by a specific Microsoft 365 user by running the script with the ‘-PerformedBy’ parameter. For example, ./AuditFileActivities.ps1 -PerformedBy [email protected] retrieves all the file activities performed by Annie for the past 180 days.

The script also allows you to track file activities in SharePoint Online using the ‘-SharePointOnline’ parameter. Running ./AuditFileActivities.ps1 -SharePointOnline displays a list of all the file activities performed in SharePoint Online alone.

To get a list of users’ file activities in Microsoft 365, you can run the script ./AuditFileActivities.ps1. This will provide a list of file downloads, modifications, uploads, deletions, etc., in both SharePoint and OneDrive.

If you want to monitor recent file activities of users in your organization, you can run the script with the ‘-StartDate’ and ‘-EndDate’ parameters. For example, ./AuditFileActivities.ps1 -StartDate 07/20/2024 -EndDate 07/30/2024 returns the users’ file activities that happened from 20th July 2024 to 30th July 2024.

To schedule a weekly or monthly report on file activities in Microsoft 365, you can run the script with ‘-StartDate’ and ‘-EndDate’ parameters. This will retrieve file and folder activities for a month or a week, depending on the parameters used.

Here's a summary of the script parameters:

Note that the date format for the ‘-StartDate’ and ‘-EndDate’ parameters should be mm/dd/yyyy.

To retrieve and monitor file activities in OneDrive, you can use the PowerShell script provided by AdminDroid. This script allows you to audit all file and folder activities performed by users in OneDrive.

You can retrieve file and folder activities in OneDrive by running the script with the '-OneDrive' parameter. This cmdlet lists all the file and folder activities performed in OneDrive, including file downloads and deletions.

To track file activities by a specific Microsoft 365 user, you can run the script with the '-PerformedBy' parameter. For example, to retrieve all the file activities performed by Annie for the past 180 days, you can use the cmdlet './AuditFileActivities.ps1 -PerformedBy [email protected]'.

If you want to focus only on SharePoint Online file activities, you can run the script with the '-SharePointOnline' parameter. This cmdlet displays a list of all the file activities performed in SharePoint Online alone.

Here are some ways to retrieve and monitor file activities in OneDrive:

These features provide you with the necessary tools to monitor and audit file activities in OneDrive and SharePoint Online, helping you identify any suspicious actions and improve security.

You can export and view reports in OneDrive to track activity on your shared files. This feature allows you to review the files and folders shared by you in OneDrive.

With the "Shared by You" report, you can track other user activities on your OneDrive files and detect accidental sharing you may have initiated.

To export file activities in SharePoint Online, you have three script execution methods to choose from.

You can run the script with Multi-Factor Authentication (MFA) and non-MFA accounts, which allows you to export the file activities report into a CSV file.

The first method is to download the script, start the Windows PowerShell, and select any of the methods provided to execute the script.

Here are the three methods to execute the script:

Method 2 requires you to explicitly pass credentials (username and password) and will only work for non-MFA admin accounts.

You can also use certificate-based authentication (Method 3) to run the script, which requires registering the app in Azure AD and allowing it to connect to EXO with a certificate.

To use certificate-based authentication, you must register the app in Azure AD and the app allows you to connect to EXO with certificate.

Viewing shared files on OneDrive can be a lifesaver when you need to track activities on your files. You can review the files and folders shared by you in OneDrive through this reporting option.

This comprehensive report allows users to detect accidental sharing they may have initiated. It's a great way to catch any mistakes before they cause issues.

Admins can use this report to take actions like revoking access or setting expiration dates based on user feedback. This keeps your shared files organized and secure.

You can also spot the OneDrive Sync reports in the Apps admin center to ensure easy mobility of files across your organization.

The Microsoft 365 admin center is where you can find all OneDrive admin settings, including OneDrive sharing settings, sync settings, storage page, device access page, and more.

You can customize the SharePoint admin center’s homepage using the “Add cards” option available in the top left corner to get a better view of OneDrive usage and reports.

The OneDrive reports in the SharePoint admin center include the Microsoft 365 OneDrive Usage Report, Overall OneDrive File Activity, and Information Barriers in OneDrive.

You can use AdminDroid, a OneDrive reporting tool, to effectively monitor OneDrive usage, file sharing, and file access to discover inactive user accounts and prevent them from being frozen.

AdminDroid offers exclusive reports on multiple Microsoft 365 services, providing 1800+ comprehensive reports and 30+ AI-powered dashboards for advanced Office 365 administration.

To stay on top of OneDrive activity, you can configure prebuilt alert policies from AdminDroid’s alerting feature to be instantly notified of suspicious OneDrive activities, such as unusual file creations, deletions, or anonymous link usage.

Here are some of the key features of AdminDroid:

To effectively manage and share files in OneDrive, you can use the "Shared with You" section, which provides information about the users who shared the files, sharing dates, and the latest file activity. This report helps you find shared content and access permissions assigned to you.

You can also inspect and examine OneDrive shared files through the "Manage Access" option. This report shows the list of users or groups who have access to a particular file, as well as their access permissions.

To access the "Manage Access" page, follow the path: OneDrive > My files > Respective file > More options > Manage Access. Analyze this report to manage organization-wide sharing settings.

OneDrive itself offers an in-depth sharing report, which provides details about the shared file and folders, including resource path, item type, permission, username, user email, link ID, and link type. To access this report, go to OneDrive > Settings > OneDrive Settings > More Settings > Manage Access > Run Sharing Report.

You can also use the AdminDroid Microsoft 365 Reporter to monitor your OneDrive for business in-depth. With AdminDroid, you can effectively monitor OneDrive usage, file sharing, and file access, and discover inactive user accounts to prevent them from being frozen.

Here's a summary of the steps to manage and share files in OneDrive:

By following these steps, you can effectively manage and share files in OneDrive, and ensure that your organization's data is safe and secure.

To check and monitor activity on OneDrive, you can use the OneDrive for business reports in the M365 admin center to get insights into your users' personal storage usage and interactions with files on the platform.

You can also view the health page of the Microsoft 365 Apps admin center to track the OneDrive sync status, which provides an executive summary of every event that happens in and around the OneDrive sync app.

The OneDrive app shows recent activity for your OneDrive files and folders, and you can view a log of recent syncing actions done to files and folders in your OneDrive by clicking the OneDrive icon on the notification area of the taskbar.

Here are the different OneDrive sync status icons you can look out for:

To check the sync status of your OneDrive files, you can view the health page of the Microsoft 365 Apps admin center. This page provides an executive summary of every event that happens in and around the OneDrive sync app, including vital information on sync status and the OneDrive sync app version of individual devices.

The sync status of files in your OneDrive is denoted with small icons beside their names. You can view a log of recent syncing actions done to files and folders by clicking the OneDrive icon on the notification area of the taskbar.

Here are the different sync status icons you might see:

The OneDrive app shows recent activity for your OneDrive files and folders, allowing you to keep track of syncing actions and optimize the sync settings if needed.

Information barriers in OneDrive are a powerful tool for organizations to safeguard sensitive data. They prevent the flow of sensitive information within the organization by restricting communication between specific users, groups, or teams through predefined policies.

Admins can implement information barriers in Microsoft Teams, SharePoint Online, and OneDrive to create boundaries among Office 365 users. This helps restrict access to specific information and maintain data privacy.

Two key areas where information barriers in OneDrive restrict access are: Access control of the user to OneDrive or stored content Permission for sharing OneDrive or stored content with other users

The SharePoint admin center allows admins to monitor the applied information barriers in OneDrive, providing a clear view of the policies in place.

To get started with tracking OneDrive file activities, you can use the AuditFileActivities.ps1 script. You can run this script to retrieve users' file activities for a specific date range in Microsoft 365.

The script requires you to specify the start and end dates using the -StartDate and -EndDate parameters, respectively. The date format should be mm/dd/yyyy.

You can also track file activities in SharePoint Online alone by running the script with the -SharePointOnline parameter.

To narrow down your search to file activities performed in SharePoint Online for the past 30 days, you can use the -SharePointOnline, -StartDate, and -EndDate parameters together.

Here's a summary of the parameters you can use to track OneDrive file activities:

You can use the following cmdlet to retrieve users' file activities for a specific date range: ./AuditFileActivities.ps1 -StartDate 07/20/2024 -EndDate 07/30/2024.

In OneDrive, you can view the sync status of your files and folders by looking at the small icons beside their names. These icons indicate whether a file or folder is only in the cloud, synced to your PC, or designated as Always keep on this device.

OneDrive's file status icons are easy to understand: a cloud icon indicates the file is only in the cloud, a green checkmark on a white circle means it's synced to your PC but will revert to cloud-only after 30 days, and a white checkmark on a green circle means it's designated as Always keep on this device.

You can also view a log of recent syncing actions done to files and folders in your OneDrive by clicking the OneDrive icon on the notification area of the taskbar.

Here's a quick rundown of OneDrive's file status icons:

Checking Storage Quota is a crucial step in maintaining your OneDrive storage within the limit. Once you surpass the limit, your files will move to read-only mode, making it hard to access and use them.

To monitor your OneDrive storage space, you should regularly check the OneDrive for business reports in the M365 admin center. This will give you insights into your users' personal storage usage and interactions with files on the platform.

Admins can efficiently monitor storage & collaboration in their organization by using the granular view of OneDrive storage consumption on the usage page.

You can view the sync status of your files and folders in OneDrive by looking for small icons beside their names. These icons indicate the status of each file or folder.

A cloud icon means the file or folder is only in the cloud. A green checkmark on a white circle indicates the file or folder is in the cloud and also saved on your PC's storage drive, but will revert to cloud-only if not accessed within 30 days.

A white checkmark on a green circle means the file or folder has been designated as Always keep on this device, and Windows will not automatically revert it to cloud-only. Animated arrows indicate a file or folder is syncing to the cloud.

You can view a log of recent syncing actions by clicking the OneDrive icon on the notification area of the taskbar.