How to Get a OneDrive Usage Report: Audit Log Best Practices

Microsoft provides a slew of features for businesses and organizations. One is the OneDrive for business, which is Microsoft’s cloud-based storage solution. It allows companies to store and work on files that authorized people can access. You can share files with others or work on them together in real time.

However, you should have an eye on the OneDrive storage so that it is used efficiently. For this, the OneDrive usage report can come in handy.

Not only it will give you details about the storage, but it will also give you details on who, what, when, and why someone accessed the storage. In this guide, we will show you the best ways to get OneDrive user activity logs report.

What is the OneDrive user activity logs report?

Before we go ahead and look at the different and effective ways of accessing the OneDrive user activity logs report, let us first understand what is a user activity logs report.

Basically, the OneDrive user activity logs report will give you detailed information on when users took different actions to access the files stored in OneDrive. The access could be from a workplace, school, or even home.

It also includes both internal and external users. Internal users are within your Microsoft 365 subscription, whereas external users are those who do not belong within the subscription.

What information is recorded or created in a user activity log report?

Here is the information that is recorded in a OneDrive user activity logs report:

Collaboration activities

• AccessInvitationAccepted: Records when a user accepts an external user invitation to access a file or folder.
• AccessInvitationCreated: Record of the instance when a user invites an external user to access a file or folder.
• AccessInvitationExpired: Captured automatically after 7 days, when an invitation to an external user has not been acted upon.
• AccessInvitationRevoked: Recorded when a user revokes an external user invitation to a file or folder.
• AccessInvitationUpdated: The event is recorded when a user updates an existing external user invitation.
• AccessRequestApproved: Captured when a user approves an internal user to access a file or folder.
• AccessRequestCreated: Recorded when an internal user requests to access another user’s file or folder for which he or she does not have permission.
• AccessRequestExpired: Captured automatically after 7 days when there is no action on the access request by the user.
• AccessRequestRejected: Captured when a user rejects an internal user request to access a file or folder.

File access and management

• FileCheckedIn: Recorded when a user checks in a file that was previously checked out.
• FileCheckedOut: The event is recorded when a user checks out a file. This also prevents other users from saving changes.
• FileCheckedOutDiscarded: Records when a user discards the lock on a previously checked-out file.
• FileCopied: Details an event when a user creates a copy of a file located in a document library.
• FileDeleted: Details an event when the user deletes a file from OneDrive for work or school clients.
• FileDownloaded: Captured when the user downloads a copy of a file to his or her hard drive.
• FileModified: Captured when a user saves a file or when a file is auto-saved.
• FileMoved: Recorded when a user moves a file located in the document library into another folder located in the document library.
• FileRenamed: Records when a user renames a file.
• FileRestored: Records when a user restores his or her file from the site recycling bin.
• FileUploaded: This is captured when a user uploads a file to a document library.
• FileViewed: The event is recorded when a user views a file from Office Online apps. Other views captured capture of other view events will be added during the Beta period.

File Sharing

• SharedLinkCreated: It is captured when a user creates a View or Edit link.
• SharedLinkDisabled: It is captured when a user disables a sharing link; in other words, the previously created link will not be accessible anymore.
• SharingRevoked: It is recorded when a user revokes the sharing permission to a file or folder to a designated user.
• SharingSet: It is captured when a user creates or updates a permission sharing to a file or folder.

How can I get the OneDrive user activity logs report?

1. Using the admin center

1. Sign in to Microsoft 365.
2. Go to the admin center.
3. Click on Reports at the left pane.
4. Click on Usage.
5. You can select Choose Columns to sort data from the report. The different columns that you can add or remove are:
   • URL
   • Deleted
   • Owner
   • Owner principal name
   • Last activity date (UTC)
   • Files
   • Active files
   • Storage used (MB)
6. Hit the Export button to get the file in CSV format.

2. Use a specialized tool

1. Download ManageEngine M365 Manager Plus tool.
2. Install the program.
3. Launch M365 Manager Plus.
4. Click on the Reports tab on the top.
5. Click on Other Services on the left pane.
6. Select OneDrive for Business Reports.
7. Click on the OneDrive Usage Reports link button on the right side.
8. Select any of the listed reports.
9. Select the Microsoft 365 Tenant for which you want to generate the report.
10. Choose the time frame of the report from the Period drop-down.
11. The report will be generated along with a graphical representation for easy understanding.

Read more about this topic

• Here’s the Ultimate Microsoft OneDrive Cheat Sheet
• OneDrive is getting this much-needed text annotation capability and it will save a lot of time
• OneDrive may soon get Magic Erase to let you edit pictures like a pro

While you can always use the in-built report generation method available in OneDrive as shown in method 1, the information in that can be viewed for an interval of 7, 30, 90, and 180 days only.

For those who wish to have granular information at hand and want to know the OneDrive usage report for a specific period in a year, then have to make use of the ManageEngine M365 Manager Plus.

You can monitor storage, user activity, file, and other aspects over a given period of time with a graphical representation of the data. You can get 25+ reports for OneDrive for Businesses.

⇒ Get ManageEngine M365 Manager Plus

What are audit log best practices to follow?

Auditing important information will help you assess the risk for each application, user, or system as a whole. While you can make use of feature-rich tools to audit for monitoring, there is some key information that you need to log:

• User IDs
• Date and time of log on and log off
• Successful or failed login attempts to access the services
• Files and networks accessed during the auspicious time frame
• Changes made to the system configurations
• Usage of system utilities and apps
• Notification or alarms triggered
• Activation of protection systems

We would suggest you make use of a trusted auditing tool called ManageEngine ADAudit Plus, to get the above and other important information.

It will help you with Windows logon auditing, account lockout analysis with source determination, work hour monitoring, real-time notifications and alerts, ransomware detection, and much more.

ManageEngine ADAudit Plus

Feature-packed auditing and monitoring tool to get you granular information.

Check price Visit website

We have a list of some of the best open-source network monitoring tools, that can help businesses keep a track of logon activities and prevent threats.

For businesses, maintaining a huge data set of credentials is important but centralizing it and managing it can be hard. You can make use of single sign-on tools, for this purpose. And if you are confused about which one to choose, then you can refer to our guide on the best single sign-on tools for businesses.

Feel free to let us know in the comments below, which one of the above solutions you used for getting the OneDrive user activity logs report.