🎉 Our Microsoft 365 Reporting & Management Tool is available in Marketplace 🚀
Microsoft Entra ID

How to Track External User Activities in Microsoft 365

As an administrator, ensuring the safety and security of your Microsoft 365 environment is paramount. Microsoft enables seamless collaboration with external partners. However, without proper monitoring, your organization may become vulnerable to threats. Monitoring external user activity in M365 is the key for admins to achieve the delicate balance between security and user productivity. This guide aids in tracking external user actions and bolstering data security in Microsoft 365.

Microsoft 365 tools
Solution 1
Solution 2
Solution 3
Solution 4
Important Tips
Errors and Resolution Steps

Using Microsoft 365 Admin Center

Microsoft 365 Permission Required
Global Administrator or any other privileged admin role.
  • Login to the Microsoft 365 Purview portal.
  • Navigate to the Audit page under Solutions.
  • Now, provide the Date range and click on "Search" to start the search. Once the search is completed, open the result and click on the ‘Export’ button to download the external user activity report.
  • Open the downloaded file and apply a filter in the 'UserId' column to get only the UserIDs containing #EXT#. Now, you have successfully generated the external user activities report using the M365 purview portal.
  • Once you've filtered those entries, review the ‘Operation’ column for details on the activities of the external Microsoft 365 user account.
Using Microsoft 365 Admin Center

Using Windows PowerShell

Microsoft 365 Permission Required
Global Administrator or any other privileged admin role.
  • Connect to Exchange Online PowerShell using the below cmdlet.
  • Windows PowerShell Windows PowerShell 
     Connect-ExchangeOnline
  • Run the below PowerShell cmdlet to view all the external user activities in M365.
  • Windows PowerShell Windows PowerShell 
     Search-UnifiedAuditLog -StartDate "MM/DD/YYYY" -EndDate "MM/DD/YYYY" -UserIds "#EXT#" -ResultSize 1000 | Format-Table CreationDate, UserType, UserIds, Operations, ClientIP, UserTypeDetails -AutoSize
Using Windows PowerShell
  • Enhance your Microsoft 365 security with vigilant oversight of external user activities.

Using PowerShell Script

Microsoft 365 Permission Required
Global Administrator or any other privileged admin role.
  • Would you like to focus solely on the significant activities carried out by external users in the M365 environment? If yes, our PowerShell script can help you easily identify and categorize these major activities.
    • Downloading sensitive files.
    • Illegal document/file modifications.
    • Confidential document access.
    • Illicit resource sharing (i.e., Resource sharing by external users), etc.
  • Furthermore, the resulting report will be conveniently exported for your use. To enjoy this streamlined experience, simply execute the provided PowerShell script and view the significant activities performed by the external users.
Using PowerShell Script
AuditExternalUserActivity.ps1

Elevate Your M365 Security: Master External User Monitoring Like a Pro!

With AdminDroid's M365 User Activity Tracker, monitoring external user activities within Microsoft 365 becomes streamlined and efficient. Moreover, it enables organizations to proactively protect digital assets and ensure secure collaboration. AdminDroid's solution stands as a reliable ally in the complex landscape of user activity monitoring, offering unparalleled visibility over external user engagements.

External User Monitoring Dashboard

Gain a graphical overview of external user activities and delve into specific actions on each workload, including success and failure rates, enabling you to revoke access for unauthorized actions through effective monitoring.

External User File Access Alerts

Utilize AdminDroid's alerting functionality, to receive notifications on any file sharings of external users, enabling effective tracking and avoiding potential security risks.

Automate the reports for weekly file access review

Keep yourself updated weekly on external users' file access activities by scheduling weekly reports to desired admins or managers.

Envision File Sharing Trend by External Users

Unlock daily insights with default built in charts to display a comprehensive summary of daily events in the File/Folder Sharing Activities by External Users report.

Supervise External Users within M365 Groups

Monitor M365 groups with external users regularly to implement restrictions to sensitive group data and prevent unauthorized sharing.

Get user insights along with activity log

With AdminDroid's Advanced customization feature, you can easily include external users'profile information in the activity reports with a few clicks.

In summary, AdminDroid optimizes your Microsoft 365 environment by efficiently managing external users through continuous activity monitoring. It provides actionable insights into their activities, empowering you to intervene as needed. Moreover, this process is seamlessly executed, minimizing any operational burden on your end.

Important Tips

Effectively oversee external sharing and reduce the risk of data loss by tracking external sharing activities in SharePoint Online.

Restrict access to external users in Entra ID to enhance your security against internal threats and unpredictable risks.

Establish the necessary prerequisites to ensure a secure connection prior to hosting a meeting with an external user.

Common Errors and Resolution Steps

The following are the possible errors and troubleshooting hints while viewing all the activities performed by the external user.

Error “xxxxx” is part of an organization. It's possible they have message-related policies that will apply to the chat.

The popup message appearing in the message box when trying to reach out an external user could be due to a result of specific message policies configured within their organization.

Fix To resolve the issue, you shall reach out them regarding their message policies, which could potentially be adjusted to allow for external user communication within their organization.

Error Search-UnifiedAuditLog: The provided start date is later than the end date. Please provide valid dates.

This error occurs when the start date provided in the PowerShell command is later than the end date.

Fix Ensure that the start date provided in the command comes before the end date. Double-check the date format to ensure it matches the required format (e.g., MM/DD/YYYY). If unsure, you can use the Get-Date cmdlet to retrieve the current date in the correct format.

Error 1 person couldn’t be added.

The error encountered when trying to add a guest to a channel could be due to specific External Access settings configured within your organization.

Fix To correct the issue, change those External Access configurations and try adding those users to desired channels.

Error Set-SPOSite: The specified site 'https://yourtenantname.sharepoint.com/sites/yoursite' does not exist.

This error occurs when attempting to change configurations to a SharePoint Online site that doesn't exist within the tenant.

Fix Double-check the URL specified in the Identity parameter to ensure that it corresponds to an existing SharePoint Online site within your organization.

Kickstart Your Journey With
AdminDroid

Your Microsoft 365 Companion with Enormous Reporting Capabilities

Download Now
Browse All Guides
User Help Manuals Compliance Docs Customer Stories
All Guides 99+
Microsoft Entra ID
Track All the External User Activities in M365
Microsoft Entra ID Guides