Based on the Auditlogs report how to track that the file or folder is shared with which user>

Question

Hello Team,

I am able to extract Audit logs from compliance portal. My question is how to get the shared user based on audit logs report. I am able to get file, folder and there URL as well. from the audit logs I need to get users which is shared with respected file.

Answer 1

Hi @Anonymous ,

To get the users which a file or folder is shared with based on the audit logs report, you can follow these steps:

1. Search the audit log for sharing events and export the results to a CSV file.
2. Use the PowerQuery Editor in Excel to format the exported audit log.
3. Filter the CSV file for resources shared with external users.

After filtering the CSV file for resources shared with external users, you can see the external user's email address in the "User" column. This email address can be used to identify the user who the file or folder is shared with.

For more details, please refer to:

https://learn.microsoft.com/en-us/purview/audit-log-sharing#how-to-identify-resources-shared-with-external-users

https://learn.microsoft.com/en-us/purview/ediscovery-export-search-results?view=o365-worldwide

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.