o365reports.com Open in urlscan Pro
172.67.189.32 Public Scan

Back to summary

URL:
https://o365reports.com/2021/03/23/audit-external-user-file-access-in-sharepoint-online-using-powershell/
Submission: On February 21 via manual (February 21st 2024, 7:14:25 am UTC) from PL — Scanned from PL

Form analysis
3 forms found in the DOM

GET https://o365reports.com/

<form role="search" method="get" class="search-form" action="https://o365reports.com/">
  <div class="vs-input-group">
    <i class="vs-icon vs-icon-search"></i>
    <div class="input-container">
      <input spellcheck="false" autocomplete="off" autocapitalize="off" type="text" value="" name="s" class="search-field" placeholder="Search o365reports.com" required="">
      <i onclick="if (!window.__cfRLUnblockHandlers) return false; exitSearch()" class="exit-search vs-icon vs-icon-x input-clear-btn"></i>
      <button aria-label="search-submit" type="submit" class="search-submit">
        <i class="vs-icon-arrow-right"></i>
      </button>
    </div>
  </div>
  <script type="text/javascript">
    function exitSearch() {
      const inputField = document.querySelectorAll('.search-form .search-field');
      if (document.body.classList.contains('search') || document.body.classList.contains('search-results')) {
        const newURL = window.location.origin + window.location.pathname;
        window.location.href = newURL;
      } else {
        inputField.forEach(field => {
          field.value = '';
        });
      }
    }
  </script>
</form>

GET https://o365reports.com/

<form role="search" method="get" class="search-form" action="https://o365reports.com/">
  <div class="vs-input-group">
    <i class="vs-icon vs-icon-search"></i>
    <div class="input-container">
      <input spellcheck="false" autocomplete="off" autocapitalize="off" type="text" value="" name="s" class="search-field" placeholder="Search o365reports.com" required="">
      <i onclick="if (!window.__cfRLUnblockHandlers) return false; exitSearch()" class="exit-search vs-icon vs-icon-x input-clear-btn"></i>
      <button aria-label="search-submit" type="submit" class="search-submit">
        <i class="vs-icon-arrow-right"></i>
      </button>
    </div>
  </div>
  <script type="text/javascript">
    function exitSearch() {
      const inputField = document.querySelectorAll('.search-form .search-field');
      if (document.body.classList.contains('search') || document.body.classList.contains('search-results')) {
        const newURL = window.location.origin + window.location.pathname;
        window.location.href = newURL;
      } else {
        inputField.forEach(field => {
          field.value = '';
        });
      }
    }
  </script>
</form>

POST #mc_signup

<form method="post" action="#mc_signup" class="subscribe-form" id="orb_signup_form">
  <input type="hidden" id="orb_submit_type" name="mc_submit_type" value="js">
  <input type="hidden" name="mcsf_action" value="mc_submit_signup_form">
  <input type="hidden" id="_mc_submit_signup_form_nonce" name="_mc_submit_signup_form_nonce" value="84754ac833"> <input autocapitalize="off" autocomplete="off" spellcheck="false" type="email" placeholder="Your email" name="mc_mv_EMAIL"
    id="mc_mv_EMAIL" value="">
  <button type="submit" name="mc_signup_submit" id="orb_signup_submit" class="btn-subscribe" value="Subscribe">Subscribe</button>
</form>

Text Content

Browse Categories
Home
Office 365 Reports
PowerShell Scripts
Tools
News
Security
Exchange Online
Office 365
SharePoint Online
All Posts



Office 365 Reports

o365reports.com



Office 365 Reports

o365reports.com

Home
Office 365 Reports
PowerShell Scripts
Tools
News
Security
Exchange Online
Office 365
SharePoint Online
All Posts
Office 365
March 23, 2021


AUDIT EXTERNAL USER FILE ACCESS IN SHAREPOINT ONLINE USING POWERSHELL

by Kathy Cooper

4 min read

2 Comments



The external sharing feature lets users in your organization share content with
people outside the organization (such as partners, vendors, clients, or
customers). So, it’s necessary to audit who accessed the file to ensure each
user is authorized.

To track external user activities, Microsoft 365 admin center doesn’t have any
built-in report. Hence, admins can use any one of the below methods to audit
external file access.

Audit log search: Admins need to apply multiple filters in audit log search to
get the desired result. However, the report can’t be customized or scheduled.

PowerShell: Search-UnifiedAuditLog cmdlet helps to search the activities
performed in the organization. But, if you don’t retrieve the audit data
properly, you will end up with data loss.

To ease your work, we have built a user-friendly PowerShell script to track
external user file accesses.




> DOWNLOAD SCRIPT: EXTERNALUSERFILEACCESSREPORT.PS1



SCRIPT HIGHLIGHTS:

 * The script uses modern authentication to connect to Exchange Online.
 * The script can be executed with MFA enabled account too.
 * Exports report results to CSV file.
 * Allows you to generate an external file access report for a custom period.
 * Automatically installs the EXO V2 module (if not installed already) upon your
   confirmation.
 * The script is scheduler friendly. I.e., Credential can be passed as a
   parameter instead of saving inside the script.







MICROSOFT 365 EXTERNAL FILE ACCESS REPORT – SAMPLE OUTPUT:

The exported SharePoint 365 external access report contains following
attributes: File Accessed Time, External User Name, Accessed File, Site URL,
File Extension, Workload and Detailed Audit Data.

The report looks similar to the screenshot below:






EXTERNAL FILE ACCESS POWERSHELL SCRIPT – EXECUTION METHODS:

To run the script, you can choose any one of the methods below.

Method 1: Execute the script with MFA and non-MFA accounts


PowerShell

./ExternalFileAccessReport.ps1
1
./ExternalFileAccessReport.ps1

The exported report contains external user file access for the past 90 days.



Method 2: Execute the script by explicitly mentioning the credentials.


PowerShell

./ExternalFileAccessReport.ps1 -AdminName admin@contoso.com -Password XXX
1
./ExternalFileAccessReport.ps1 -AdminName admin@contoso.com -Password XXX

Note: Scheduling works only for non-MFA accounts. If the admin account has MFA,
then you need to disable MFA based on the Conditional Access policy to make it
work.







UNLOCK FULL POTENTIAL OF EXTERNAL FILE ACCESS POWERSHELL SCRIPT

 * Export Office 365 external user file access for the past 90 days
 * Audit Office 365 external user file access within a particular interval
 * Get a monthly external file access report
 * Schedule external file access report



EXPORT EXTERNAL USER FILE ACCESS REPORT FOR THE PAST 90 DAYS:

Since Search-UnifiedAuditLog has past 90 days data, we can get a maximum of the
last 90 days of user’s file accesses using our script. To export Office 365
external user file access for the past 90 days, run the script as mentioned
below.


PowerShell

./ExternalFileAccessReport.ps1
1
./ExternalFileAccessReport.ps1

Note: If a user is assigned with Office 365 E5 or Microsoft 365 E5 or Microsoft
365 Compliance or E5 Discovery and Audit add-on license, then you can generate
an audit log for more than 90 days. In that case, you can use –StartDate and
–EndDate params to specify the time range.



AUDIT EXTERNAL USER FILE ACCESS FOR A PARTICULAR INTERVAL

You can generate an external users’ file access report for a custom period by
mentioning –StartDate and –EndDate params.


PowerShell

./ExternalFileAccessReport.ps1 -StartDate 03/16/2021 -EndDate 03/23/2021
1
./ExternalFileAccessReport.ps1 -StartDate 03/16/2021 -EndDate 03/23/2021

The exported report helps to audit who accessed the files within a custom
period. You can generate an external access audit report for the last 7 days, 30
days, 90 days, or any other required period.



SCHEDULE EXTERNAL USER FILE ACCESS REPORT:

As Search-UnifiedAuditLog can take audit logs for the past 90 days, you may
require old audit data for analysis. In that case, scheduling will help you to
automate the script execution. You can schedule the script to run a pre-defined
time to keep the audit log for more than 90 days.

To create PowerShell scheduled task, you can use Windows Task Scheduler and
follow the format below.


PowerShell

./ExternalFileAccessReport.ps1 -AdminName admin@contoso.com -Password XXX
1
./ExternalFileAccessReport.ps1 -AdminName admin@contoso.com -Password XXX

The exported report contains external users’ file access for the past 90 days.



GET A MONTHLY EXTERNAL FILE ACCESS REPORT:

To get a monthly report for external user file access, you can run the script as
follows,

The exported report contains external user file access for the past 90 days.


PowerShell

./ExternalFileAccessReport.ps1 -StartDate ((Get-Date).AddDays(-30)) -EndDate
(Get-Date)
1
./ExternalFileAccessReport.ps1 -StartDate ((Get-Date).AddDays(-30)) -EndDate
(Get-Date)

The exported report has the last 30 days of external users’ file access audit
data.



I hope this blog is helpful to track when external users accessed the files. If
you have any queries or requirements, share them with us through the comment
section.




EFFORTLESSLY AUDIT EXTERNAL FILE ACCESS IN SHAREPOINT ONLINE WITH ADMINDROID

With the growing importance of protecting sensitive data from external threats,
it is crucial to have a comprehensive approach to audit external file access in
SharePoint Online that goes beyond the PowerShell method. Therefore, say goodbye
to native auditing and hello to detailed insights presented in visually stunning
charts, real time alerts, customizable reports, and dashboards.

 * AdminDroid Microsoft 365 Reporter has got you covered with everything you
   need to monitor and track external file access activities with extra
   effortlessness! Plus, it also has separate reports for files accessed by
   admins and others such as files previewed, downloaded, and deleted by admins.

AdminDroid’s SharePoint reports provide in-depth insights on external user file
access activities such as file accessed location, file extension details,
accesses file URL, and relative file URL. You can also filter SharePoint file
access count by accessed file, accessed user with daily accessed summary in the
form of charts and graphs.





If you’re looking for a tool to audit your SharePoint Online environment, look
no further than AdminDroid’s SharePoint Auditing tool. Regardless of the size of
your business, this tool can help you manage your environment with greater
efficiency. SharePoint Online management is made easy with AdminDroid and has
comprehensive dashboards for widespread visibility! Moreover, the tool offers
advanced features such as delegation, advanced scheduling, and advanced
filtering that can help you manage your SharePoint Online environment with ease.

Therefore, if you’re looking to gain a comprehensive understanding of your
SharePoint Online environment and ensure compliance with legal requirements,
then give AdminDroid a try with our free 15-day premium edition. Don’t settle
for limited reports, choose AdminDroid and experience the benefits of complete
visibility and control over your SharePoint Online environment.

Join the thousands of satisfied customers who rely on AdminDroid for their
Office 365 administration needs!

External user file access reportSharePoint external file access reportSharePoint
Online file access report
Share article



EXPORT OFFICE 365 ADMIN ROLE REPORT USING POWERSHELL


MICROSOFT DOWNSIZES HIGHER VOLUME MAILBOXES – YOUR MAILBOXES WILL BE THROTTLED
FOR AN HOUR


You may also like these blogs:
 * Office 365 Auditing Report Tool
 * Audit File Access in SharePoint Online Using PowerShell
 * Export Office 365 External User Reports for Secure…
 * SharePoint Online Reporting and Auditing Tool 
 * Configure External Sharing in SharePoint Online
 * Get Multiple Built-in SharePoint Usage Reports to…


Table of Contents

 * Download Script: ExternalUserFileAccessReport.ps1
 * Microsoft 365 External File Access Report – Sample Output:
 * External File Access PowerShell Script – Execution Methods:
 * Unlock Full Potential of External File Access PowerShell Script
 * Export External User File Access Report for the Past 90 Days:
 * Audit External User File Access for a Particular Interval
 * Schedule External User File Access Report:
 * Get a Monthly External File Access Report:
 * Effortlessly Audit External File Access in SharePoint Online with AdminDroid



Share article




AdminDroid
One tool solution for complete Microsoft 365 Management

Get report on anything in Microsoft 365

Learn More



Be the first to know!

Receive timely M365 updates, tips, and news directly in your inbox.


Subscribe



Office 365 Reports
Categories
Home
Office 365 Reports
PowerShell Scripts
Tools
News
Security
Exchange Online
Office 365
SharePoint Online
All Posts
Quick Links
Newsletter
Connect

facebook

twitter

instagram

linkedin

reddit

o365reports.com Open in urlscan Pro 172.67.189.32 Public Scan

Form analysis 3 forms found in the DOM

GET https://o365reports.com/

GET https://o365reports.com/

POST #mc_signup

Text Content

o365reports.com Open in urlscan Pro
172.67.189.32 Public Scan

Form analysis
3 forms found in the DOM