How to Audit Changes to Sharing Settings in MS Teams and SharePoint Online

Office 365 has many great collaboration features, and in the modern era of remote offices and widespread work from home, collaboration is key. In particular, both SharePoint Online and MS Teams provide users with a variety of options for making documents, sites and even whole segments of the IT environment accessible to others, both inside and outside the organization. 

This flexibility dramatically increases security risks, so it is essential to control and monitor how and with whom your various resources are being shared. Unfortunately, native tools are limited. The native audit log is retained for just 90 days, which impedes investigations. Searching the audit log online via the Security and Compliance center is slow and sometimes confusing, since seemingly similar events can appear in different sections. On top of this, while some activities, such as sharing via a direct link, are quite transparent, other actions are not. For instance, to inspect sharing inheritance and changes to sharing policy, admins have to open and review each individual event to understand which settings have been changed, a time-consuming process that puts them at risk of missing important details.

Netwrix Auditor for SharePoint overcomes all these drawbacks. Instead of manually sifting through cryptic events for hours, you can get all necessary information in a few clicks in one out-of-the-box report. You get clear details about all changes to security group membership, policies and sharing settings in SharePoint Online and Teams, including critical actions like promoting a user to site collection administrator. You can also see precisely who shared what data with which users, so you can stay on top of sharing data with external users. In addition, you can subscribe yourself or other designated personnel to receive this report by email on schedule, facilitating regular review to ensure that potentially harmful changes never go unnoticed.