Sharing Events

Below is a description of sharing events that are recorded when users perform sharing operations in SharePoint or OneDrive. These are colour coded in the main report to indicate the potential seriousness of the action. Red - Potentially very bad need to act! Amber - May be ok but could still be bad. Action needed! Blue - Probably OK but you need to be aware. This could lead to something worse. Green - Harmless no action needed

AccessRequestAccepted

An access request to a site, folder, or document was accepted and the requesting user has been granted access.

AccessRequestCreated

User requests access to a site, folder, or document they don't have permissions to access.

AccessRequestDenied

An access request to a site, folder, or document was denied.

AccessRequestUpdated

An access request to an item was updated.

AddedToSecureLink

A user was added to the list of entities who can use a secure sharing link.

AnonymousLinkCreated

User created an anonymous link to a resource. Anyone with this link can access the resource without having to be authenticated.

AnonymousLinkRemoved

User removed an anonymous link to a resource. The link can no longer be used to access the resource.

AnonymousLinkUpdated

User updated an anonymous link to a resource. The updated field is included in the EventData property.

AnonymousLinkUsed

An anonymous user accessed a resource by using an anonymous link. The user's identity might be unknown, but you can get other details such as the user's IP address.

CompanyLinkCreated

User created a company-wide link to a resource. company-wide links can only be used by members in your organization. They can't be used by guests.

CompanyLinkRemoved

User removed a company-wide link to a resource. The link can no longer be used to access the resource.

CompanyLinkUsed

User accessed a resource by using a company-wide link.

PermissionLevelAdded

A permission level was added to a site collection.

RemovedFromSecureLink

A user was removed from the list of entities who can use a secure sharing link.

SecureLinkCreated

A secure sharing link was created to this item. (recipient may be unknown but has to authenticate)

SecureLinkDeleted

A secure sharing link was deleted.

SecureLinkUsed

A user used a secure link.

SharingInvitationAccepted

User (member or guest) accepted a sharing invitation and was granted access to a resource. This event includes information about the user who was invited and the email address that was used to accept the invitation (they could be different). This activity is often accompanied by a second event that describes how the user was granted access to the resource, for example, adding the user to a group that has access to the resource.

SharingInvitationCreated

User shared a resource in SharePoint Online or OneDrive for Business with a user who isn't in your organization's directory.

SharingInvitationUpdated

An external sharing invitation was updated.

SharingRevoked

User (member or guest) unshared a file, folder, or site that was previously shared with another user.

SharingSet

User (member or guest) shared a file, folder, or site in SharePoint or OneDrive for Business with a user in your organization's directory. The value in the Detail column for this activity identifies the name of the user the resource was shared with and whether this user is a member or a guest. This activity is often accompanied by a second event that describes how the user was granted access to the resource. For example, adding the user to a group that has access to the resource.