Auditing of SharePoint Online for External Sharing

Question

Good day all. Having spent some time searching, I have come to you finally.
I have been checking in Audit, within https://compliance.microsoft.com/ to see who changed a setting in a tenant for SharePoint External Sharing, and also the 14 days link expirary.
Could I seek your guidance on how to do this please?
This is for tenant level, not site level.

SharingPolicyChanged is what I have seen in one audit I have exported so far, but I can't see that anyone with rights has made any changes.

I would also like to know who or what changed the setting within "Allow only users in specific security groups to share externally"

Thanks in advance, Al

Answer 1

Hi @Al Godsmark , welcome to Q&A forum!

Per my test, if we want to get changes to the Sharing policy, we see the user's behavior:

================================================

I have checked the introduction of the official article, and there is currently no entry about changes in external sharing settings in the activities recorded in the Audit log in the compliance center.

For more information you could refer to:
Search the audit log in the compliance center

Generally, global admin permissions are required to change the settings of external sharing. You could go to Microsoft 365 admin center>Active Users to check the permissions of each user, and then ask the relevant users:

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.