Office 365 OneDrive monitoring
You have as many OneDrives as employees. When did anyone last review one?
Every user carries a personal site with its own permissions, its own sharing links and its own sensitive files - and no governance review ever opens it. In a typical tenant, a large share of "anyone with the link" URLs were created from OneDrive, and the drives of people who left are still reachable for weeks after they are gone. 1Security treats every OneDrive as a site: listed, ranked by exposure, monitored for downloads and sharing, cleaned up behind a review window.
The problem
Personal drives, corporate data, zero reviews.
The convenient path for a working file is the personal drive: draft there, share from there, move on. Multiply that by every employee and OneDrive quietly becomes where a large share of live corporate content sits - budgets, contracts, exports of customer lists, the HR spreadsheet someone downloaded to "work on it at home".
Sharing from OneDrive works exactly like sharing from a site: anyone links, organization-wide links, direct external invitations. But while SharePoint sites get owners and reviews, personal drives get neither. A link created three years ago from a drive nobody audits is still a door today - sharing links have no expiry unless someone set one.
Then the owner leaves. The account is disabled, the license reclaimed - and the OneDrive, links included, stays reachable for a retention period of about 30 days before deletion. Nobody checks what it still exposes in those weeks. Across a year of leavers that is hundreds of drives with live links and nobody responsible for them.
In practice
The OneDrive review that never existed - in four passes.
How personal drives become governed territory in 1Security, in the first afternoon.
- 01
Split the tenant into sites and drives
The container filter on Files, Sites and links separates SharePoint sites from personal OneDrives in every view. Sort personal sites by storage, external users or sharing links and the top of the list is where the risk sits - typically a few dozen drives carry most of the exposure.
- 02
Sweep the links
Filter Files to personal drives with anyone links, links without a password or links past their expiration, then cross with sensitivity detections - 300+ detectors plus OCR, or imported Purview labels. In most tenants this shortlist is a few hundred files, and it is the shortlist that matters.
- 03
Audit the leavers
Filter Users to disabled or departed accounts and open the drives that still have active links or external users. Expire the links, revoke the grants and stage the cleanup - behind the 72-hour review window - while the retention window is still open, not after it closes.
- 04
Keep it watched
New sharing and downloads from personal drives show up in Activity logs within about ten minutes. Put a policy on "OneDrive anyone link plus sensitive content" and an activity alert on "more than 500 downloads in an hour" and the next incident is an email, not a discovery.
What makes it work
Drives are sites. Access is resolved to the file.
OneDrive governance falls out of three decisions the platform made early.
Every drive is a site
Personal OneDrives sit in the same inventory as SharePoint sites - members, links, storage, sensitive detections and activity, ranked by the same exposure logic.
Explore the feature →Lifecycle sees the leavers
Offboarding audits connect the departed account to everything it still exposes - including its drive and the links it created.
Explore the feature →Access, resolved to the file
Who can reach a file in a personal drive and through which grant - direct, link, group or inheritance - with revocation staged from the same view.
Explore the feature →
FAQ
Common questions.
Does this read the content of people's personal files?
Content is streamed through the sensitivity analysis and discarded. Only the detection type, match count and confidence are stored - never the matched values. 1Security holds a map of exposure, not a copy of anyone's drive.
Can we clean up links without breaking people's work?
Cleanup is staged, not instant. Proposed link removals wait in a review window - 72 hours by default - where they can be approved, rejected or routed to the drive owner, and every executed change is logged in Actions. Nothing disappears silently.
What happens to a OneDrive after the person leaves?
It stays for a retention period of about 30 days before deletion, and its links stay live in the meantime. In 1Security the drive and its links remain visible and attributable after the account is disabled, so you expire what it exposed instead of hoping retention gets there first. License reclaim rides the same flow.
Do we need E5 or a separate DLP product for this?
No. Read-only connection, standard Microsoft 365 licensing, no agent. Sensitivity detection is 1Security's own; if you already run Purview, its labels and detections are imported alongside.
The 1Security platform
OneDrive Monitoring is just the beginning
OneDrive Monitoring is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- Users, groups and lifecycleDormant accounts, guests who never left, groups nested three deep, orphaned owners, admins without MFA. The review that is a spreadsheet everywhere else.
- External domainsEvery outside organization with a foothold in the tenant, its trust posture, its drift, and who it was invited by.
- Email and mailboxesWho can read whose mailbox, forwarding rules, threads with sensitive content, inbound and outbound exposure.
- LicencesWhat is assigned, what is unused, and which bundle an action or feature still needs, so the upgrade you sell is the one the client needs.
- Security scoreThe score, its history, the controls behind it and the benchmarks, so the number on the board report means something.
- ComplianceNIS2, DORA, GDPR, EU AI Act, SOC 2 and HIPAA as requirements with a live status, attestations, dated snapshots and evidence packs.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
Give the other half of your tenant its first review.
Connect read-only and filter to personal drives with anyone links and sensitive content - most teams have their shortlist within the first hour.
Or keep reviewing only the half that has meetings.