SharePoint Online

How to Get SharePoint Online User Activity Report

Q: How to track external sharing activities by SPO site users?

Preventing sensitive information leaks through unapproved external sharing is a crucial concern for many organizations. Employees may unintentionally share confidential data outside the organization via SharePoint Online. To identify and address these potential security risks, it's essential to monitor external sharing activities. Here’s how you can effectively manage and track SharePoint Online external sharing activities across different methods. Using SharePoint Online site Navigate to the website where you need to generate the report. Go to the Settings (gear icon) » Site usage menu in the top-right corner of the page. Look for the " Shared with external users " section and click on Run report . Once the report is generated, choose a location and click Save to store the report. The saved report compiles details like username, permissions, user type, email, resource path, item type, and more. Using PowerShell script Download and execute the given PowerShell script below to audit external sharing activities in SharePoint Online. ExternalSharingReport.ps1 Instead of manually filtering and executing cmdlets, the script above automates tasks using a task scheduler, accepts credentials as parameters, and lets you filter for SharePoint Online or OneDrive external sharing events. This script allows you to track shared items, users who shared items, external users who received items, event time, sharing type, and more. Overcome the limitations of native methods in tracking event times and history trends with AdminDroid’s SharePoint Online external sharing report. The File/Folders Shared to External Users audit report provides insights into SPO external sharing activities. You can refine this report by applying the Workload filter to SharePoint . The report consolidates event time, item name, site URL, user who shared the item, recipient, user's IP address, and more.

Are you looking to gain deeper insights into how your users are engaging with SharePoint Online? Understanding user activity on this broad collaborative platform is crucial for maintaining security and efficiency. Without proper oversight, users might access confidential files, misuse permissions, or even share sensitive information with external parties. This guide will show you how to generate a SharePoint Online user activity report to identify risky behaviour patterns and optimize access management.

Using the Microsoft 365 Admin Center

Microsoft 365 Permission Required

User Experience Success Manager Least Privilege

Global Admin Most Privilege

Login to the Microsoft 365 admin center.
Navigate to Reports » Usage » SharePoint and then select the Activity tab.
This report will show the users' activity trends and their last activity date in SharePoint Online.
It organizes activities like Viewed, Edited, Synced, and Shared (internally and externally) into separate graphs for Files and Users. The Pages graph displays the number of unique pages visited by users.
Use the Export option to download user activity details as a CSV file.

Note: SharePoint Online typically retains user activity data for 180 days. This means that data older than 180 days will be deleted automatically.

Using Windows PowerShell

Microsoft 365 Permission Required

User Experience Success Manager Least Privilege

Global Admin Most Privilege

Connect to the Microsoft Graph PowerShell using the below cmdlet.

Windows PowerShell

 Connect-MgGraph -Scopes "Reports.Read.All"

Execute the following cmdlet to export the SharePoint user activity report in CSV format.

Windows PowerShell

 Get-MgReportSharePointActivityUserDetail -Period <Days> -OutFile <FilePath>

Note: Replace <Days> with the desired period (e.g., D7, D30, or D180) and replace <FilePath> with the output file path where you want to save the report.

Simple & Quick
Using AdminDroid

AdminDroid Permission Required Delegated

Any user with report access assigned by the Super Admin.

Login to the AdminDroid Office 365 reporter.
Access the Daily Summary of Users by their SharePoint File Activity report under Reports » SharePoint » Daily Activity Summary » Daily Summary of Users by Activity.

AdminDroid SharePoint Online Reporting tool

Tracking SharePoint Online user activity is now easier than ever!

The AdminDroid SharePoint Online reporting tool offers robust user activity tracking, providing detailed insights into how SPO users access, share, and modify documents. These insights enable you to enforce best practices, streamline operations, and foster a collaborative yet secure work environment.

Uncover the User Behind the File Deletions in SharePoint Online

Audit SharePoint Online file deletions to ensure users accountability and prevent unauthorized removal of critical documents, thereby maintaining data integrity and supporting compliance efforts.

Optimize SPO Resources with Users' Management Activities

Eliminate uncontrolled SharePoint Online accumulation with SPO management activities by user report to identify modification patterns and underutilized resources.

Manage SharePoint Online External Users Activities Seamlessly

Effortlessly manage SharePoint Online external user activity with detailed reports. Ensure streamlined security by verifying permissions to protect site content from unauthorized access.

Stay Alert to Unusual External File Sharing in SPO

Use the default alert template for unusal volume of external file sharing and apply SharePoint in Workload filter to get instant alert about excessive file sharing with external parties.

Get Daily SharePoint Online Usage Trends with Scheduling

Schedule daily active users summary report and have it delivered straight to your mailbox, which helps you in monitoring SharePoint users' activity in Microsoft 365.

Identify Hidden Risks with Anonymous Link Audit

Track all anonymous link creations and accesses to see who created the links and when they were accessed, making it easier to identify suspicious activities.

In conclusion, AdminDroid's advanced SharePoint Online management tool helps you to effectively monitor and manage user actions within SharePoint Online. By offering detailed insights into interactions, file access, and sharing, it enhances your visibility and control. These SharePoint Online analytics reports enhance your ability to enforce proper user permissions and safeguard sensitive data.

Explore a full range of reporting options

Download Live Demo

Important Tips

Audit external user file access in SharePoint Online to safeguard important files from unauthorized access.

Remove inactive users in SharePoint Online to save storage space, licenses, and reduce costs in your Microsoft 365 environment.

Restrict SharePoint Online user sharing to specific domains, ensuring that sensitive information is accessible only by trusted organizations.

Common Errors and Resolution Steps

The following are possible errors and troubleshooting hints while dealing with SharePoint Online user activity.

Error Your organization doesn’t allow sharing with users from this domain. Please contact your IT department for help.

This error might occur when you try to add external users from domains not listed in the SharePoint admin center.

Fix

From SharePoint admin center, Navigate to Policies » Sharing » More external sharing settings, then uncheck the Limit external sharing by domain.

Error Something went wrong. We ran into a problem. Please click the invitation or sharing link you received to try again.

This error might occur when an external user tries to access the SharePoint site before accepting the sharing invitation link.

Fix

Instruct external users to check their mailbox for the invitation link sent from the SharePoint Online site. They should accept the invitation and login with their credentials to access the site.

Error Get-SPOExternalUser : If position is greater than zero, it must be less than the number of external users that match the search criteria.

This error occurs if the -Position value in the Get-SPOExternalUser cmdlet is greater than or equal to the total number of matching external users, or if there are fewer external users than the specified position.

Fix

You should first determine the total number of external users that match your search criteria, then ensure that the -Position value is within the valid range. Use the cmdlet below to get external users in SharePoint Online.

Get-SPOExternalUser -Position 0 -PageSize 50

Error Get-MgReportSharePointActivityUserDetail : {"error":{"code":"InvalidArgument","message":"Invalid period value specified: D6. Supported values are: D7,D30,D90,D180"}}

This error will occur when you use an invalid value for the period parameter.

Fix

Use valid periods such as D7, D30, D90, D180. For example, to get spo users activity for the last 90 days use the cmdlet below.

Get-MgReportSharePointActivityUserDetail -Period D90 -OutFile */spouseractivity.csv

Error Connect-SPOService : The remote server returned an error: (403) Forbidden.

This error occurs when you try to connect to the SharePoint Online admin center without an admin role assigned.

Fix

Ensure that you have the necessary administrative permissions, such as SharePoint Online admin or Global admin, to connect the SharePoint Online admin center.

SharePoint Online

Frequently Asked Questions

Gain Insights into User Engagement with SharePoint Online User Activity Reports!

How to get a list of users with access to the SharePoint Online site?

How to monitor user activity for a specific file on a SharePoint site?

How to track external sharing activities by SPO site users?

How to identify who invited external users to SPO sites?

How to track who has viewed or accessed SharePoint Online pages?

How to audit file usage statistics by users in SharePoint online?

1. How to get a list of users with access to the SharePoint Online site?

When managing sensitive information on a SharePoint Online site with varying user permissions, it’s essential to prevent the risk of external data sharing. To ensure proper access control, follow these steps to list all users with site access and revoke any unnecessary permissions.

You can see the list of SharePoint Online users by following the methods below.

From SharePoint admin center

Sign in to the SharePoint admin center.
Navigate to Sites » Active sites section.
Click the desired SharePoint Online site and go to the Membership tab.
Here, you can view SharePoint Online site users categorized by their membership level, such as site owners, site admins, site members, and visitors. This helps you understand their permissions and manage their privileges effectively.

From Windows PowerShell

Connect to the SharePoint Online PowerShell using the cmdlet below.
```
Connect-SPOService -Url https://<yourtenant>-admin.sharepoint.com
```
Execute the following cmdlet to get a list of users granted access to the SharePoint Online site, including their default group and permission level.
```
Get-SPOUser -Site <SiteURL> -Limit All | Select-Object -Property DisplayName, LoginName, Groups, Usertype | Format-Table
```

Empower yourself with complete control over your SharePoint Online sites with AdminDroid’s automated collection of user access information.

Just head to the SharePoint Online Site Users report in AdminDroid to find out which users have access to your SPO sites.
The report offers you details such as user name, site address, email, site group membership, etc.

2. How to monitor user activity for a specific file on a SharePoint site?

Tracking user activity for specific files on a SharePoint Online site is crucial for maintaining data integrity and preventing unauthorized access. By monitoring file access, modifications, and deletions, you can identify responsible individuals and take timely action to protect your valuable data.

You can monitor user activity for a particular file using the methods below.

Using file version history in SharePoint Online

Open your SharePoint Online site and go to the document library where the file is stored.
Click on the ellipsis (...) next to the file name and select Version history.
Tap the drop-down in the date & time field, and then select View.
This displays all users who edited the file, along with the date/time of each edit and the changes made.

Using the Microsoft Purview compliance portal

Navigate to Audit Log Search.
Customize the date and time range if required.
Set Record types to SharePointFileOperation.
Paste the file URL in the File, folder, or site field as mentioned below.
```
https://<yourtenant>.sharepoint.com/DocumentLibrary/File
```
Note: Provide the full URL or a portion of it, excluding spaces and special characters. You can use the wildcard (*) to cover variations or incomplete URLs.
Click the Search button.
Once the search is completed, you can view the user activities for a specific file, including who accessed the file, when it was accessed, and the actions they performed.

Stay informed about every action taken on your important SharePoint Online files with AdminDroid!

The SharePoint File/Folder Access report from AdminDroid helps you view all the activities performed by the users on the SharePoint Online files and folders.
This report includes the user's name, department, job title, activity time, file/folder name, and operation performed, which can help you detect if any unintended users are accessing sensitive files.

Handy Tip: Use the Target File filter to view user activities for a specific file.

4. How to identify who invited external users to SPO sites?

Understanding who invites external users helps in managing permissions effectively. This ensures that the designated Microsoft 365 users have appropriate access levels, maintaining data integrity and confidentiality within SharePoint sites.

Get External User Invites in SPO Sites Using PowerShell

Execute the cmdlet below to identify who invited external users to the SharePoint Online sites.

Connect-SPOService -Url https://<yourtenant>-admin.sharepoint.com
 
Get-SPOExternalUser | Select DisplayName, Email, InvitedBy, AcceptedAs, WhenCreated

In the result, the InvitedBy column shows who invited guest users to your SharePoint Online environment.

Audit external user invites in the Microsoft Purview compliance portal

Navigate to the Audit Search page and set desired start and end date.
Select Created sharing invitation, Accepted sharing invitation in the Activities – friendly names field.
Hit the Search button to get the activity log history. It provides details such as the invite time, who invited, target user, item, and more.

Discover how easy it is to find out who invited external users to your SharePoint Online site with AdminDroid!

Access AdminDroid’s dedicated report on SharePoint External User Invites, designed to streamline your external user invitation tracking.
This report provides granular details such as event time, invitation sender and receiver, sender IP, shared item, and more, ensuring that external sharing aligns with organizational policies.

Handy Tip: Use the alert feature (bell icon) in the report to get immediate notifications for site collection invitations shared with external users.

5. How to track who has viewed or accessed SharePoint Online pages?

For teams working on collaborative projects, it’s important to ensure that all members are actively engaging with the shared content. By tracking page access, you can monitor team involvement and take steps to ensure that all team members are actively participating and viewing important content.

Understand standard metrics of SPO page views

By default, SharePoint does not display detailed metrics on who accessed or viewed SharePoint Online pages. To view page visitor information, you must activate a specific site-level feature, which requires Site Owner permissions.

How to activate SharePoint Online viewers' feature?

Navigate to the desired SharePoint Online site.
Go to Settings » Site information » View all site settings » Site Actions and select Manage Site Features.
Locate SharePoint Viewers and click Activate.

Track SharePoint Online Page Traffic

To track who has viewed pages on your SharePoint Online site, follow the steps below.

Go to the Pages tab of your SharePoint site.
Right-click on a page file and select Details to view visitors and their access information.
Alternatively, you can use "Site usage" under Site contents or the "Analytics" option available on the page to see the views and viewers count.

Bring all SharePoint Online page view activities to light in one place with AdminDroid!

Use the Viewed SharePoint Pages report from AdminDroid to track and monitor all page view activities on SharePoint Online.
This report simplifies page interaction management and analysis by providing a centralized overview, eliminating the need to navigate individual sites for viewer details.

6. How to audit file usage statistics by users in SharePoint online?

In today's digital age, where data breaches are commonplace, protecting your SharePoint Online files is paramount. Auditing who accesses, modifies, and shares these files adds a crucial layer of security. Therefore, tracking these activities helps prevent unauthorized access and ensures the integrity of your sensitive information.

Audit File Usage in SharePoint Online Using PowerShell

With the help of the Get-MgReportSharePointActivityUserDetail PowerShell cmdlet, you can get the aggregated information on SharePoint users’ activity. But it doesn't offer in-depth details like a file name, name of the activity performed, user’s IP address, file location, site URL, etc.

Overlooking SharePoint Online user’s activity logs can result in missing critical indicators such as file deletions, modifications, or access patterns, which may indicate accidental or intentional data loss.

That’s where our comprehensive guide lends a hand! It provides you with efficient methods to audit file usage by users in SharePoint Online.

Here is a quick glimpse!

Microsoft Purview compliance portal: It explains how to use the Purview compliance portal to audit SharePoint Online file activities by users and details on file usage.
PowerShell Script: It provides the script for generating reports on SharePoint Online users’ file usage details with customization capabilities.
AdminDroid SharePoint Online Reporter: A simple report on SharePoint file usage from AdminDroid enables you to quickly act on managing user interactions with files. It offers automated reporting features and visual analytics focusing solely on important file usage activities.