How to Audit Who Granted OneDrive Access to Others in Microsoft 365

Sharing OneDrive access is helpful during the absence of the primary user, such as during vacations or emergencies. It ensures teamwork and workflows continue smoothly without admin help, as users can easily share their entire OneDrive.

Other users will get access to your OneDrive when a user is given site collection administrator rights. To do so, follow the steps below.

Similarly, users can revoke other's access by excluding them from the site collection administrators.

Note: Users can remove any site collection administrator from their OneDrive, regardless of whether they were added by another user or an admin.

An admin can access a user’s OneDrive without consent during situations like employee deprovisioning or emergencies to ensure important files remain accessible. Once accessed, the admin can download the files or move them to their own OneDrive. This ensures critical data is always available when needed.

Note: The link created will work only for the global admin who generated it. This method should be used only in rare cases and is generally not encouraged.

When multiple users need access to OneDrive for cross-team collaborations or shared projects, administrators can use group-based access. They can grant access to multiple users in bulk to streamline management.

Note: Add site admins only to the Site Collection Administrators field. Avoid making any changes to the Primary Site Collection Administrator field, as it may result in the respective user losing access.

To grant OneDrive access, first connect to the SharePoint Online Management Shell using the below cmdlet.

Connect-SPOService -Url "<AdminCenterURL>"

Next, run the script below, replacing “<Target User's UPN>” with the UPN of the user whose OneDrive needs to be shared, and "<email@example.com>" with the site collection administrators to whom you want to grant access.

$targetSite = Get-SPOsite -IncludePersonalSite $true -Filter "Owner -eq <Target User's UPN>" | Where-Object { $_.Url -like "*/personal/*"}
$userEmails = @("<email1@example.com>", "<email1@example.com>")
foreach ($userEmail in $userEmails) {Set-SPOUser -Site $targetSite.Url -LoginName $userEmail -IsSiteCollectionAdmin $true}

Similarly, to revoke admin access to a user's OneDrive, execute the code snippet below.

$targetSite = Get-SPOsite -IncludePersonalSite $true -Filter "Owner -eq <Target User's UPN>" | Where-Object { $_.Url -like "*/personal/*"}
$userEmails = @("<email1@example.com>", "<email2@example.com>")
foreach ($userEmail in $userEmails) {Remove-SPOUser -Site $targetSite.Url -LoginName $userEmail}

OneDrive for Business is a secure platform for storing and sharing files, used for tasks like file management, projects, and data recovery. However, granting full access can expose sensitive data, as recipients can modify, delete, or share files without oversight.

That’s why setting up alerts when OneDrive access is granted helps maintain accountability and protect data by identifying unauthorized activities.

• This template ensures that alerts are triggered exclusively for OneDrive access and eliminates unnecessary notifications related to SharePoint site access.
• Additionally, AdminDroid’s threat management alert report categorizes all alerts generated by Microsoft 365, making it easier to analyse them without feeling overwhelmed.