How to track OneDrive user activity on a specific file?
+
When a sensitive OneDrive file containing financial or proprietary information is shared with multiple external users, it becomes essential to track who has accessed it and whether unauthorized users have downloaded or modified the contents. In such scenarios, you must closely monitor file activity to mitigate potential risks, ensure data integrity, and prevent any misuse.
The steps below will help you monitor user activity on specific files in OneDrive and keep you informed about any modifications made.
- Sign in to the Microsoft Purview Compliance portal.
- Navigate to the Solutions»Audit»Search.
- Choose the date and time range for your audit (start date and end date).
- In the Workloads field, select OneDrive. Enter the file name in the File, folder, or site field.
- Click Search to start the search.
The result displays the file activity details, including actions such as accessing, syncing, downloading, and other interactions that have occurred with that file.
- This report tracks who accessed the files, when these actions occurred, and the type of access involved. Use the filtering feature to track the activities on a specific file.
- By analyzing this report, you can identify potential risks, monitor how users are handling sensitive files, and detect patterns of activity that may indicate unauthorized access or misuse.