Help on audit logs

Question

Hi All,

I need help with audit log searches in Microsoft Purview.

I want to identify all SharePoint Online and OneDrive links that have been shared with external or guest users (i.e., users outside my organization/domain).

Requirement:

• Search audit logs for file/folder sharing activities
• Identify links shared with users who are not part of my domain
• Capture details such as:
• User who shared the file
• Target external/guest user
• File/URL shared
  • Timestamp

Question: What is the correct way to perform this search in Purview Audit?

• Which activities/operations should I filter on?
• Is there a specific query or advanced filter to identify external sharing events?

Any guidance or sample queries would be appreciated

Answer 1

Dear @Roger Roger,

Sharing occurs when a user (the acting user) shares a resource with another user (the target user). Audit records related to sharing a resource with an external user (a user who is outside of your organization and doesn't have a guest account in your organization's Microsoft Entra ID) are identified by the following events, which the audit log records. For more information, please refer to Sharing auditing work flow You can use sharing auditing in the Microsoft 365 audit log to determine how resources are shared in your organization, including sharing activities involving users outside of your domain

When a user shares a file, folder, or site with another user, Microsoft 365 records these activities using the SharePoint Sharing schema, which provides additional fields such as:

• TargetUserOrGroupType identifies whether the resource was shared with a Member, Guest, Security Group, etc.
• TargetUserOrGroupName identifies the user the resource was shared with

These fields, along with other audit properties such as User, Operation, and Date, help determine which user shared what resource with whom and when. Additionally, the ObjectId field in the audit record identifies the file, folder, or site that was shared with the external user.

For more detailed step‑by‑step guidance, please refer to Microsoft’s official documentation here: Use sharing auditing in the audit log – Microsoft Learn

Moreover, if you need more help or require more specific guidance based on your tenant environment, I recommend creating a support ticket in the Microsoft 365 Admin Center so that Microsoft Support can further assist you with your scenario. For reference:  Get support | Microsoft Docs   

Note: Please understand that as a forum moderator, my role is to provide general guidance and troubleshooting support. I don’t have access to internal systems or backend tools, and I appreciate your understanding of these limits.

I hope the information shared helps point you in the right direction. Please try the steps above and let me know if they work. If not, we can continue working together to narrow this down.

The first response may not always resolve the issue right away, but with your help and more details, we can work toward a solution.

Thank you for your patience and understanding. I'm looking forward for your reply.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Use Microsoft Purview Audit to search for sharing and access request activities, export the results, and then filter for external (guest) users.

1. Run an audit search for sharing events
2. Sign in to the Microsoft Purview portal.
3. Select Audit (or View all solutions → Audit).
4. On the Search page, under Activities – friendly names, select Sharing and access request activities.
5. Set the Date and time range (UTC) for the period to investigate.
6. Select Search to run the query.
7. When results are returned, select Export results → Download all results, and save the CSV file.

This search uses the unified audit log and will include SharePoint Online and OneDrive sharing events.

2. Expand audit data into usable columns

The CSV contains an AuditData column with JSON. Use Excel Power Query to split this into separate columns so that user, target, object, and operation fields can be filtered:

1. Open the CSV in Excel.
2. Use Data → Get Data → From File and open the CSV with Power Query.
3. Use the JSON transform in Power Query to expand the AuditData column into individual columns.
4. Load the transformed data back into Excel.

(For detailed steps, see “Step 2: Format the exported audit log using the Power Query Editor” in the referenced article.)

3. Filter for external/guest sharing events

With the expanded data in Excel:

1. On the Home tab, select Sort & Filter → Filter.
2. On the Operations column, filter to the sharing-related operations that indicate link creation or external invitations, for example:
   • SharingInvitationCreated – resource shared with a user not in the organization’s directory.
   • AnonymousLinkCreated – anonymous link created.
   • SecureLinkCreated – secure sharing link created.
   • AddedToSecureLink – user added to a secure link.
3. On the TargetUserOrGroupType column, filter to Guest.

Rows that remain represent sharing events where the target is outside the organization. External users are identified by TargetUserOrGroupType:Guest.

4. Extract the required details

From the filtered rows, use these columns:

• UserId / User (depending on expansion) – the user who shared the file or created the link.
• TargetUserOrGroupName (or similar) – the external/guest user.
• ObjectId – the resource that was shared; for example:
  • ObjectId:https:\/\/contoso-my.sharepoint.com\/personal\/user_contoso_com\/Documents\/FileName.docx
• CreationTime (or equivalent timestamp field) – when the sharing event occurred.
• Operation – type of sharing event (e.g., SharingInvitationCreated, AnonymousLinkCreated).

5. Optional: Use PowerShell or API instead of the portal

Instead of the portal UI, the same audit data can be queried via:

• Search-UnifiedAuditLog in Exchange Online PowerShell, then exported to CSV and processed as above.
• Office 365 Management Activity API for programmatic retrieval of audit data.

These approaches still rely on filtering for the same operations and TargetUserOrGroupType = Guest to identify external sharing.

Summary of key filters

• Activity scope in Purview Audit: Sharing and access request activities.
• Operations to focus on for link/external sharing:
  • SharingInvitationCreated
  • AnonymousLinkCreated
  • SecureLinkCreated
  • AddedToSecureLink
• External users: TargetUserOrGroupType = Guest.

This combination gives a list of SharePoint Online and OneDrive resources shared with external/guest users, including sharer, target user, resource URL, and timestamp.

---

References:

• Use sharing auditing in the audit log
• Audit log activities
• Search the audit log
• Search, review, and refine results in Data Security Investigations
• Search the audit log to investigate common support issues