SharePoint gets the governance attention, but OneDrive is where external sharing quietly accumulates: files shared "just quickly" with a supplier, Teams chat attachments, personal working copies of business documents. In our testing, OneDrive — not SharePoint — accounted for the bulk of the highest-severity findings. Reporting on it tenant-wide is harder than it should be.
Why OneDrive is the blind spot
- Every user has one. Each OneDrive is technically its own site collection. A 400-person tenant means 400 separate libraries to audit.
- Sharing is personal. Nobody reviews a colleague's OneDrive the way a site owner reviews a team site. Shares outlive projects, contractors, and employment.
- Teams routes files there. Every file attached to a 1:1 or group chat lands in the sender's OneDrive, with permissions granted to the chat participants — including external ones.
- Other apps store there too. Loop components, OneNote notebooks, Stream recordings, and Whiteboard files live in OneDrive (or SharePoint) as files — shared like files, exposed like files.
The native options, honestly
Per-user sharing reports
An admin can open an individual OneDrive (after granting themselves access) and export its sharing report. That answers the question for one user. Repeating it for the whole tenant is hundreds of manual rounds — and granting yourself access to colleagues' OneDrives is itself the kind of action you'd rather not do routinely.
PowerShell across all drives
Scripting the loop — enumerate users, enumerate each drive, walk each item's permissions — is the complete route, with the usual costs: real engineering effort, throttling on any tenant of size, and raw output that repeats every inherited grant on every file it touches.
Data Access Governance
Microsoft's admin-center reports cover OneDrive sharing too — behind the SharePoint Advanced Management / Copilot licence wall. See our guide to that licence gap.
One pass over every OneDrive
TRACER365 treats OneDrive as a first-class audit surface: one read-only scan enumerates every OneDrive in the tenant alongside every SharePoint site — no per-user access grants, no scripts. It surfaces anonymous "Anyone" links, direct grants to guests, specific-people links with external recipients, and inherited exposure, each severity-ranked and de-duplicated (in our testing roughly 91% of raw findings collapsed as duplicates).
Two OneDrive-specific behaviours worth knowing:
- Locked drives are reported, not skipped. OneDrives under a Microsoft 365 retention or legal hold return "locked" to every audit tool — no vendor can override that. TRACER365 lists them explicitly in its coverage report, so you know which drives exist but could not be audited, instead of getting silence.
- Chat attachments are covered — they're OneDrive files, so they're in the scan. (They aren't labelled "shared via Teams chat" in the current version; that context label is on the roadmap.)