Share via

Auditing of SharePoint Online for External Sharing

Al Godsmark 1 Reputation point
2021-11-04T17:27:07.67+00:00

Good day all. Having spent some time searching, I have come to you finally.
I have been checking in Audit, within https://compliance.microsoft.com/ to see who changed a setting in a tenant for SharePoint External Sharing, and also the 14 days link expirary.
Could I seek your guidance on how to do this please?
This is for tenant level, not site level.

SharingPolicyChanged is what I have seen in one audit I have exported so far, but I can't see that anyone with rights has made any changes.

I would also like to know who or what changed the setting within "Allow only users in specific security groups to share externally"

Thanks in advance, Al

SharePoint
SharePoint
A group of Microsoft Products and technologies used for sharing and managing content, knowledge, and applications.
10,154 questions
SharePoint Server Management
SharePoint Server Management
SharePoint Server: A family of Microsoft on-premises document management and storage systems.Management: The act or process of organizing, handling, directing or controlling something.
2,879 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Elsie Lu_MSFT 9,791 Reputation points
    2021-11-05T06:55:49.74+00:00

    Hi @Al Godsmark , welcome to Q&A forum!

    Per my test, if we want to get changes to the Sharing policy, we see the user's behavior:
    146706-108.png

    ================================================

    I have checked the introduction of the official article, and there is currently no entry about changes in external sharing settings in the activities recorded in the Audit log in the compliance center.

    For more information you could refer to:
    Search the audit log in the compliance center

    Generally, global admin permissions are required to change the settings of external sharing. You could go to Microsoft 365 admin center>Active Users to check the permissions of each user, and then ask the relevant users:
    146792-109.png

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.