SharePoint Online audit log activity

Question

Hello,

I have created an spfx banner and my business condition is to check if external sharing is enabled, domain allowed and everyone M365 group is added to a site or not.

I am able to check the external sharing from the site properties but can't pull the Domain Sharing List and check if "M365 Everyone except external users" is added or not.

I have created a PS script and hosted it in Azure Function that does a check and stores the data on a config list from where the spfx checks.

The issue is, 40k sites...takes a long to iterate and update the config list.

The alternative is to capture the event. If anything thing happens (add user, change policies etc) at the site collection level (Tenant Level), is there any way to trigger an event to a webhook with the site URL? that's sufficient for me to do the rest of the logic.

Same case if everyone is added on a site, an event should trigger with the URL. The rest can be managed in the code?

The question is how do do it?

Thanks
Aniruddha

Answer 1

Hi @Aniruddha Aditya ,

SharePoint service only offers list/library webhook. If you want to receive SPO audit event, you may take a reference of Office 365 Management Activity API:

• https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#step-1-run-an-audit-log-search
• https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference?view=o365-worldwide

Best Regards,
Baker Kong

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

@bakerkadour436qw Kong-MSFT Thank you for your response. Based on your input,

I have created the APP token and Secret and provided appropriate permission on SharePoint.

I am getting the AF20023 - The subscription is disabled and not able to fetch the events. Already there are events that I have created from the portal.

I am using the below code:

$ClientID = ""
$ClientSecret = "
$loginURL = "https://login.microsoftonline.com/";
$tenantdomain = "dddd.onmicrosoft.com"
$TenantGUID = "22e45340-059b-410d-bf4a-sadfsfs"
$resource = "https://manage.office.com"

$body = @{grant_type="client_credentials";resource=$resource;client_id=$ClientID;client_secret=$ClientSecret}
$oauth = Invoke-RestMethod -Method Post -Uri "$loginURL/$TenantGUID/oauth2/token?api-version=1.0" -Body $body
$headerParams = @{'Authorization'="$($oauth.token_type) $($oauth.access_token)"}
Invoke-WebRequest -Headers $headerParams -Uri "$resource/api/v1.0/$TenantGUID/activity/feed/subscriptions/content?contentType=Audit.SharePoint"