Azure AD

How to Track External User Activities in Microsoft 365

As an administrator, ensuring the safety and security of your Microsoft 365 environment is paramount. Microsoft enables seamless collaboration with external partners. However, without proper monitoring, your organization may become vulnerable to threats. Monitoring external user activity in M365 is the key for admins to achieve the delicate balance between security and user productivity. This guide aids in tracking external user actions and bolstering data security in Microsoft 365.

Using Microsoft 365 Admin Center

Microsoft 365 Permission Required

Global Administrator or any other privileged admin role.

Login to the Microsoft 365 Purview portal.
Navigate to the Audit page under Solutions.
Now, provide the Date range and click on "Search" to start the search. Once the search is completed, open the result and click on the ‘Export’ button to download the external user activity report.
Open the downloaded file and apply a filter in the 'UserId' column to get only the UserIDs containing #EXT#. Now, you have successfully generated the external user activities report using the M365 purview portal.
Once you've filtered those entries, review the ‘Operation’ column for details on the activities of the external Microsoft 365 user account.

Using Windows PowerShell

Microsoft 365 Permission Required

Global Administrator or any other privileged admin role.

Connect to Exchange Online PowerShell using the below cmdlet.
Windows PowerShell
```
 Connect-ExchangeOnline
```
Run the below PowerShell cmdlet to view all the external user activities in M365.

Windows PowerShell

 Search-UnifiedAuditLog -StartDate "MM/DD/YYYY" -EndDate "MM/DD/YYYY" -UserIds "#EXT#" -ResultSize 1000 | Format-Table CreationDate, UserType, UserIds, Operations, ClientIP, UserTypeDetails -AutoSize

Enhance your Microsoft 365 security with vigilant oversight of external user activities.

Using PowerShell Script

Microsoft 365 Permission Required

Global Administrator or any other privileged admin role.

Would you like to focus solely on the significant activities carried out by external users in the M365 environment? If yes, our PowerShell script can help you easily identify and categorize these major activities.
- Downloading sensitive files.
- Illegal document/file modifications.
- Confidential document access.
- Illicit resource sharing (i.e., Resource sharing by external users), etc.
Furthermore, the resulting report will be conveniently exported for your use. To enjoy this streamlined experience, simply execute the provided PowerShell script and view the significant activities performed by the external users.

AuditExternalUserActivity.ps1

Using AdminDroid Office 365 Reporter
Simple & Quick

AdminDroid Permission Required Delegated

Any user with report access delegated by the Super Admin.

Login to the AdminDroid Office 365 reporter.
Navigate to the User Activities by External Users dashboard under Dashboard»User Activities»By External Users.

AdminDroid M365 User Activity Tracker

Elevate Your M365 Security: Master External User Monitoring Like a Pro!

With AdminDroid's M365 User Activity Tracker, monitoring external user activities within Microsoft 365 becomes streamlined and efficient. Moreover, it enables organizations to proactively protect digital assets and ensure secure collaboration. AdminDroid's solution stands as a reliable ally in the complex landscape of user activity monitoring, offering unparalleled visibility over external user engagements.

External User Monitoring Dashboard

Gain a graphical overview of external user activities and delve into specific actions on each workload, including success and failure rates, enabling you to revoke access for unauthorized actions through effective monitoring.

External User File Access Alerts

Utilize AdminDroid's alerting functionality, to receive notifications on any file sharings of external users, enabling effective tracking and avoiding potential security risks.

Automate the reports for weekly file access review

Keep yourself updated weekly on external users' file access activities by scheduling weekly reports to desired admins or managers.

Envision File Sharing Trend by External Users

Unlock daily insights with default built in charts to display a comprehensive summary of daily events in the File/Folder Sharing Activities by External Users report.

Supervise External Users within M365 Groups

Monitor M365 groups with external users regularly to implement restrictions to sensitive group data and prevent unauthorized sharing.

Get user insights along with activity log

With AdminDroid's Advanced customization feature, you can easily include external users'profile information in the activity reports with a few clicks.

In summary, AdminDroid optimizes your Microsoft 365 environment by efficiently managing external users through continuous activity monitoring. It provides actionable insights into their activities, empowering you to intervene as needed. Moreover, this process is seamlessly executed, minimizing any operational burden on your end.

Explore a full range of reporting options

Download Live Demo

Important Tips

Effectively oversee external sharing and reduce the risk of data loss by tracking external sharing activities in SharePoint Online.

Restrict access to external users in Entra ID to enhance your security against internal threats and unpredictable risks.

Establish the necessary prerequisites to ensure a secure connection prior to hosting a meeting with an external user.

Common Errors and Resolution Steps

The following are the possible errors and troubleshooting hints while viewing all the activities performed by the external user.

Error “xxxxx” is part of an organization. It's possible they have message-related policies that will apply to the chat.

The popup message appearing in the message box when trying to reach out an external user could be due to a result of specific message policies configured within their organization.

Fix To resolve the issue, you shall reach out them regarding their message policies, which could potentially be adjusted to allow for external user communication within their organization.

Error Search-UnifiedAuditLog: The provided start date is later than the end date. Please provide valid dates.

This error occurs when the start date provided in the PowerShell command is later than the end date.

Fix Ensure that the start date provided in the command comes before the end date. Double-check the date format to ensure it matches the required format (e.g., MM/DD/YYYY). If unsure, you can use the Get-Date cmdlet to retrieve the current date in the correct format.

Error 1 person couldn’t be added.

The error encountered when trying to add a guest to a channel could be due to specific External Access settings configured within your organization.

Fix To correct the issue, change those External Access configurations and try adding those users to desired channels.

Error Set-SPOSite: The specified site 'https://yourtenantname.sharepoint.com/sites/yoursite' does not exist.

This error occurs when attempting to change configurations to a SharePoint Online site that doesn't exist within the tenant.

Fix Double-check the URL specified in the Identity parameter to ensure that it corresponds to an existing SharePoint Online site within your organization.

Azure AD

Frequently Asked Questions

Boost Your Microsoft 365 Security with Diligent Monitoring of External User Activities

What are the primary activities of an external user in Microsoft 365?

In Microsoft 365, external users are vital for facilitating seamless communication and collaboration across organizations. One of their primary activities includes leveraging email collaboration features to exchange information and share documents across organizations effortlessly.

Let's delve into their other primary activities within the M365 ecosystem.

OneDrive and SharePoint Document Collaboration External users can seamlessly collaborate on shared documents stored in SharePoint Online or OneDrive. They can view, edit, and co-author files, fostering efficient teamwork across organizational boundaries.
Participation in Teams Meetings Leveraging Microsoft Teams, external users can join meetings hosted by internal team members. Through audio, video, and chat functionalities, they actively contribute to discussions, brainstorming sessions, and decision-making processes. In overall aspect, enabling external chat and meetings in Microsoft Teams facilitates communication with users outside your organization.
Accessing SharePoint Sites External users gain access to designated SharePoint sites, enabling them to engage in project-specific activities, access relevant resources, and contribute to content creation and management.

Top 5 key strategies for secure external collaboration in Microsoft 365

Use Guest Accounts: Grant external users with temporary access to specific resources within your Microsoft 365 environment without compromising security.
SharePoint Online with Conditional Access: Restrict access to SharePoint Online resources based on conditions such as user location, device compliance, and login risk.
Microsoft Teams with Azure AD B2B: Enable secure collaboration by inviting external partners to Teams channels using Azure AD B2B, ensuring controlled access to conversations and files.
Microsoft Information Protection: Safeguard sensitive information by applying encryption, access restrictions, and data loss prevention policies across Microsoft 365 applications.
Azure Active Directory Privileged Identity Management: Manage and monitor access rights within Azure AD, reducing the risk of unauthorized access and potential security breaches.

Bonus Tip - By configuring external sharing settings at the tenant level, administrators can limit the level of access granted to external users, ensuring security and compliance while promoting collaboration within the organization's digital ecosystem.

Using AdminDroid’s Sharing Policy Setting Changes at Tenant Level report, you can effortlessly monitor alterations in external sharing settings made at the tenant level. Furthermore, you'll also gain insights into the timestamp of the activity and the admin responsible for the changes.

How to monitor guest user login activities in Microsoft 365?

Tracking external user login activities is essential for maintaining the security of your systems and data for a couple of key reasons:

Detecting Unauthorized Access: Monitoring login attempts helps identify suspicious activity such as logins from unusual locations or times, failed login attempts, and sudden spikes in external user access.
Ensuring Compliance: Monitoring logins ensures external users comply with data access regulations and access restrictions.
Maintaining Data Security: Tracking logins helps identify potential data breaches or leaks by external users who may not adhere to the same security protocols as internal employees.
Identifying Risky Behavior: Unusual login patterns from external users can indicate compromised accounts or unauthorized data access attempts.
Maintaining User Accountability: Tracking external user logins creates an audit trail for understanding resource access, aiding in security incident response and data leak prevention.

In summary, tracking external user logins provides visibility into who is accessing your systems and from where. This allows you to identify potential threats and ensure that only authorized users are gaining access to your data.

Run the below PowerShell cmdlet to get all the external user login activities.

Search-UnifiedAuditLog -StartDate "MM/DD/YYYY" -EndDate "MM/DD/YYYY" -Operations UserLoggedIn -UserIds "#EXT#"  -ResultSize 1000 | Format-Table CreationDate, UserType, UserIds, Operations, ClientIP, UserTypeDetails -AutoSize

With AdminDroid's All External and Internal Guest User Logins report, you can effortlessly access records of both successful and unsuccessful login attempts, including their respective timestamps, using the easy filter option with just a few clicks.

In addition, with the help of logged in application column, you can easily track the resources accessed by external users’ in your Microsoft 365 environment.
This time-saving tool proves invaluable for administrators tasked with monitoring external user logins, streamlining the process significantly.

How to monitor external user file activities in SharePoint/OneDrive?

Monitoring external user file access activities in Microsoft 365 involves tracking and analyzing actions such as document views, edits, and downloads performed by users outside the organization's network. For example, a company using Microsoft 365 might employ regular monitoring to ensure the security of sensitive files shared with external clients.

By implementing this practice, the organization can promptly identify any unauthorized access attempts, detect potential data breaches, and enforce key security measures to manage external sharing and access in SharePoint Online.

Run the below PowerShell cmdlet to get the external user file access activities.

Search-UnifiedAuditLog -StartDate "MM/DD/YYYY" -EndDate "MM/DD/YYYY" -UserIds "#EXT#" | Where-Object { $_.Operations -like "File*"} | Format-Table

What are the reasons for granting external access to files in M365?

Maximizing Collaboration: Two Key Reasons for External Access in Microsoft 365.

Seamless Collaboration: Granting specific file access allows teams to work together in real-time, eliminating communication barriers and accelerating project timelines.
Remote Work Support: External access empowers remote team members to access files and contribute to projects from anywhere, ensuring continuous and productive collaboration regardless of location.

What are the potential risks associated with enabling external user file activity?

Securing Your Data: Understanding the Risks of External User File Activity in M365.

Data Loss: Sensitive information leaks due to accidental or malicious sharing by external users.
Limited Visibility: Reduced ability to track external user activity, making it harder to identify suspicious behavior.
Weaker Security: External users might have weaker security practices, increasing vulnerability to phishing attacks.

AdminDroid's report on File/Folder Sharing Activities by External Users offers a streamlined approach to monitoring external user file activities. With its user-friendly filtering options, administrators can easily track all file sharing activities of specific external users using the convenient 'Operation Performer' filter.

What are the capabilities of external and guest users in Microsoft Teams?

Tracking external and guest user activities in Microsoft Teams allows organizations to monitor interactions between internal and external collaborators, ensuring security and compliance with company policies. For instance, a multinational corporation collaborating with external consultants and vendors need to track their activities within Teams,

To safeguard sensitive data exchange through Teams.
To ensure adherence to Teams regulatory requirements.
To implement Teams security best practices for a threat free collaboration.

Understanding external and guest users' capabilities

External Access:

Join meetings: External users can be invited to and participate in Teams meetings, even if they don't have a Microsoft 365 account.
Chat (limited access): They can chat with members of your organization who have Microsoft accounts. However, they cannot participate in team chats or channels.
Make calls (limited access): External users can make calls to other Teams users with Microsoft accounts, but they cannot see phone numbers for dial-in participants.
No file collaboration: Cannot access your Teams, channels, files, or other resources.

Guest Access:

Full Team Collaboration- Guests can be invited to join a specific team, granting them almost the same capabilities as regular team members. This includes,

Participating in team chats and channels: Guests can chat with other team members, both in private chats and channels.
Joining meetings: Guests can make and receive calls, including video conferencing, with other team members.
Making calls: Guests can join meetings scheduled by team members and participate fully.
Collaborating on files stored within the team: Guests can access and collaborate on files shared within the team through the Files tab. This allows them to view, edit, and co-author documents.

Using AdminDroid’s External User Activities in Teams report, you can monitor external user activities in your Microsoft Teams. Furthermore, you'll also gain insight into the timestamp of the activity and the individual responsible for the action.

How to block external user activities in M365?

Managing external or guest user access is crucial for both security and privacy reasons. To ensure a secure environment, certain guest user restrictions are often recommended. These restrictions commonly include limitations on accessing sensitive data, modifying settings, or performing administrative actions. Specific restrictions can vary depending on the platform and organization's security policies.

Recommended restrictions for external user activities in Microsoft Teams

Limiting external user channel creation: Limit external users from creating channels to prevent unauthorized creation of collaboration spaces.
Restricting meeting policies for external users: Define meeting policies for external users to control features like recording access and screen sharing permissions.
Blocking the downloads of Teams meeting recordings: Block downloads of meeting recordings to ensure sensitive information isn't downloaded and shared externally.

Recommended restrictions for external user activities in SharePoint & OneDrive

Blocking file downloads: Blocking downloads prevent unauthorized copying of files stored in SharePoint and OneDrive.
Preventing External Users from Re-sharing: Stop external users from resharing files and folders with others outside your organization, maintaining control over data distribution.
Limiting Guest Access Expiration: Set expiration times for guest access to SharePoint sites, ensuring temporary collaborators don't have permanent access.
Blocking Users from Syncing Files: Block syncing of files to external devices to prevent unauthorized access to your data even if a device is lost or stolen.

How to Track External User Activities in Microsoft 365

Using Microsoft 365 Admin Center

Using Windows PowerShell

Using PowerShell Script

Using AdminDroid Office 365 Reporter Simple & Quick

Elevate Your M365 Security: Master External User Monitoring Like a Pro!

External User Monitoring Dashboard

External User File Access Alerts

Automate the reports for weekly file access review

Envision File Sharing Trend by External Users

Supervise External Users within M365 Groups

Get user insights along with activity log

Important Tips

Effectively oversee external sharing and reduce the risk of data loss by tracking external sharing activities in SharePoint Online.

Restrict access to external users in Entra ID to enhance your security against internal threats and unpredictable risks.

Establish the necessary prerequisites to ensure a secure connection prior to hosting a meeting with an external user.

Common Errors and Resolution Steps

Error “xxxxx” is part of an organization. It's possible they have message-related policies that will apply to the chat.

Error Search-UnifiedAuditLog: The provided start date is later than the end date. Please provide valid dates.

Error 1 person couldn’t be added.

Error Set-SPOSite: The specified site 'https://yourtenantname.sharepoint.com/sites/yoursite' does not exist.

Frequently Asked Questions

Boost Your Microsoft 365 Security with Diligent Monitoring of External User Activities

What are the primary activities of an external user in Microsoft 365?

Top 5 key strategies for secure external collaboration in Microsoft 365

How to monitor guest user login activities in Microsoft 365?

How to monitor external user file activities in SharePoint/OneDrive?

What are the reasons for granting external access to files in M365?

What are the potential risks associated with enabling external user file activity?

What are the capabilities of external and guest users in Microsoft Teams?

Understanding external and guest users' capabilities

How to block external user activities in M365?

Recommended restrictions for external user activities in Microsoft Teams

Recommended restrictions for external user activities in SharePoint & OneDrive

Kickstart Your Journey With AdminDroid

Using AdminDroid Office 365 Reporter
Simple & Quick

Kickstart Your Journey With
AdminDroid