Netskope Help

Microsoft Office 365 OneDrive for Business Audit Events

The following list of audit events are supported for Microsoft Office 365 OneDrive for Business: For event description, refer to the Microsoft article.

Event Name

AccessInvitationAccepted

AccessInvitationCreated

AccessInvitationExpired

AccessInvitationRevoked

AccessInvitationUpdated

AccessRequestAccepted

AccessRequestApproved

AccessRequestCreated

AccessRequestDenied

AccessRequestExpired

AccessRequestRejected

ActivationEnabled

Add app role assignment grant to user

Add app role assignment to group

Add application

Add delegation entry

Add device

Add domain to company

Add external user to group.

Add group

Add member to group

Add member to role

Add OAuth2PermissionGrant

Add owner to application

Add owner to group

Add owner to service principal

Add partner to company

Add policy

Add policy to service principal

Add registered owner to device

Add registered users to device

Add role member to Role

Add service principal

Add service principal credentials

Add unverified domain

Add user

AddedToGroup

AddedToSecureLink

AdministratorAddedToTermStore

AdministratorDeletedFromTermStore

AllowGroupCreationSet

AnonymousLinkCreated

AnonymousLinkRemoved

AnonymousLinkUpdated

AnonymousLinkUsed

AppCatalogCreated

Assign external user to application.

AuditPolicyRemoved

AuditPolicyUpdate

AzureStreamingEnabledSet

Batch invites processed.

Batch invites uploaded.

Change user license

Change user password

ChannelAdded

ChannelDeleted

CollaborationTypeModified

CompanyLinkCreated

CompanyLinkRemoved

CompanyLinkUsed

Consent to application

Create application password for user

Create company

CreateSSOApplication

CustomizeExemptUsers

DefaultLanguageChangedInTermStore

Delete device

Delete group

Delete user

DeleteSSOApplication

DisableSharingForNonOwners

eDiscoveryHoldApplied

eDiscoveryHoldRemoved

eDiscoverySearchPerformed

ExemptUserAgentSet

Failed Login

FileAccessed

FileCheckedIn

FileCheckedOut

FileCheckOutDiscarded

FileCopied

FileDeleted

FileDeletedFirstStageRecycleBin

FileDownloaded

FileFetched

FileModified

FileMoved

FilePreviewed

FileRenamed

FileRestored

FileSyncDownloadedFull

FileSyncDownloadedPartial

FileSyncUploadedFull

FileSyncUploadedPartial

FileUploaded

FileViewed

Finish applying group based license to users

FolderCreated

FolderDeleted

FolderDeletedFirstStageRecycleBin

FolderModified

FolderMoved

FolderRenamed

FolderRestored

ForeignRealmIndexLogonCookieCopyUsingDAToken

ForeignRealmIndexLogonInitialAuthUsingADFSFederatedToken

GroupAdded

GroupRemoved

GroupUpdated

Invite external user.

LanguageAddedToTermStore

LanguageRemovedFromTermStore

LegacyWorkflowEnabledSet

Login

MaxQuotaModified

MaxResourceUsageModified

MemberAdded

MemberRemoved

MySitePublicEnabledSet

NewsFeedEnabledSet

ODBNextUXSettings

OfficeOnDemandSet

PageViewed

PasswordLogonCookieCopyUsingDAToken

PasswordLogonInitialAuthUsingADFSFederatedToken

PasswordLogonInitialAuthUsingPassword

PeopleResultsScopeSet

PreviewModeEnabledSet

QuotaWarningEnabledModified

Redeem external user invite.

Remove app role assignment from user

Remove delegation entry

Remove domain from company

Remove eligible member from role

Remove member from group

Remove member from role

Remove OAuth2PermissionGrant

Remove owner from group

Remove Partner from company

Remove policy credentials

Remove role member from Role

Remove service principal

Remove service principal credentials

RemovedFromGroup

RemovedFromSharedWithMe

RemovedFromSiteCollection

RenderingEnabled

Reset user password

ResourceWarningEnabledModified

Restore user

Revoke consent

SearchCenterUrlSet

SecondaryMySiteOwnerSet

SecureLinkCreated

SecureLinkUsed

SendToConnectionAdded

SendToConnectionRemoved

Set Company contact information

Set Company Information

Set delegation entry

Set DirSyncEnabled flag on company

Set domain authentication

Set federation settings on domain

Set force change user password

Set group license

Set license properties

Set Password Policy

SharedLinkCreated

SharedLinkDisabled

SharingInheritanceBroken

SharingInvitationAccepted

SharingInvitationCreated

SharingInvitationRevoked

SharingPolicyChanged

SharingRevoked

SharingSet

SiteAdminChangeRequest

SiteCollectionAdminAdded

SiteCollectionAdminRemoved

SiteCollectionCreated

SitePermissionsModified

SiteRenamed

SSOGroupCredentialsSet

SSOUserCredentialsSet

Start applying group based license to users

SyncGetChanges

TeamCreated

TeamDeleted

TeamSettingChanged

Trigger group license recalculation

UnmanagedSyncClientBlocked

Update application

Update device

Update domain

Update external secrets

Update group

Update policy

Update service principal

Update user

UpdateSSOApplication

UserAddedToGroup

UserLoggedIn

UserLoginFailed

UserRemovedFromGroup

Verify domain

Verify email verified domain

VideoRequested

Viral tenant creation.

Viral user creation.

WACTokenShared