How to generate a historical OneDrive folder sharing and access report for the past 2–3 years?

With an E3-licensed account, activity older than the applicable Purview Audit retention period cannot be recovered retrospectively unless it was previously exported or collected by another system; produce the report by combining the retained audit events with a separate snapshot of current permissions.

1. Historical sharing and access

Audit (Standard) retains records for 180 days. Records generated before October 17, 2023 had a 90-day default retention period. Changing the license or creating a retention policy now does not restore expired records—the retention lifetime is determined when the audit pipeline receives each record.^1^

Therefore, a complete 2–3-year report is possible only if older records already exist in one of these places:

• A SIEM or archive populated through the Office 365 Management Activity API.
• Previously exported Purview CSV files.
• Another monitoring or backup product that collected the events while they remained available.

Audit Premium provides one-year default retention for OneDrive and SharePoint activity for appropriately licensed users. Retention policies can extend this to 10 years with the required add-on, but policies are prospective, not retroactive.^2^

2. Search the retained period for the folder tree

In Microsoft Purview portal → Audit → Search:

1. Select a date range within the available retention period. A single portal search can span no more than 180 days.
2. Use the main folder’s path or URL in Keyword Search.
3. Select the relevant sharing and access operations.
4. Export the completed results to CSV.
5. In Excel/Power Query, expand the AuditData JSON and retain records whose ObjectId starts with the main folder’s URL/path.

Keyword Search only searches indexed fields in the common audit schema, not every property inside AuditData. Consequently, filtering the exported ObjectId values by the folder-path prefix is the more reliable way to include descendants.^3^

Relevant sharing operations include:

• SharingSet — shared with an internal directory user or guest.
• SharingRevoked
• SecureLinkCreated
• AddedToSecureLink — identifies the person added to a specific-people link.
• AnonymousLinkCreated and AnonymousLinkUsed
• SharingInvitationCreated and SharingInvitationAccepted
• FileAccessed for authenticated access through secure links.

For external sharing, fields such as TargetUserOrGroupName, TargetUserOrGroupType, and ObjectId help identify the recipient, guest status, and affected resource.^4^ The complete operation definitions are listed in the audit activity reference.^5^

For repeatable extraction, Search-UnifiedAuditLog supports filtering by operations, users, target objects, and date range. Use the same folder-path prefix against the returned JSON:

$operations = @(
  "SharingSet","SharingRevoked","SecureLinkCreated",
  "AddedToSecureLink","AnonymousLinkCreated",
  "AnonymousLinkUsed","FileAccessed"
)

$events = Search-UnifiedAuditLog -StartDate $start -EndDate $end `
  -Operations $operations -SessionId "OneDriveFolderAudit" `
  -SessionCommand ReturnLargeSet -ResultSize 5000

$events | ForEach-Object { $_.AuditData | ConvertFrom-Json } |
  Where-Object ObjectId -like "$folderUrl*" |
  Export-Csv .\FolderAudit.csv -NoTypeInformation

Repeated calls with the same session are required until no further records are returned. ReturnLargeSet supports exhaustive searches up to 50,000 results; Microsoft recommends the Management Activity API for larger programmatic collection.^6^

3. Inventory who still has access

Microsoft Graph can enumerate the folder tree and retrieve each item’s current effective permissions, but it does not replace expired audit history. For each folder:

Import-Module Microsoft.Graph.Files

$children = Get-MgDriveItemChild `
  -DriveId $driveId -DriveItemId $folderItemId -All

$permissions = Get-MgDriveItemPermission `
  -DriveId $driveId -DriveItemId $folderItemId

$permissions | Select-Object Id, Roles, GrantedToV2,
  GrantedToIdentitiesV2, Link, InheritedFrom

Recursively call Get-MgDriveItemChild for every item having a folder facet.^7^

The permissions endpoint reports direct and inherited effective permissions, sharing links, recipients, and roles. It must be called separately for each item; permissions cannot be expanded while listing a folder’s children.^8^ For application access, the documented least-privileged permission is Files.Read.All; an item owner receives all sharing permissions, while a non-owner may receive only permissions applicable to that caller.

This snapshot answers who currently has access and how, but it cannot reliably reconstruct an expired sharing event’s original actor, date, subsequently revoked recipient, or historical access. Those answers require retained audit events.

4. Microsoft-native current-state reports

As a site administrator, run OneDrive → Settings → OneDrive settings → More settings → Run sharing report. It creates a CSV of every unique file, user, permission, and sharing link in that OneDrive.^9^ Filter its item paths to the requested main folder. This is a current-state report, not a 2–3-year activity report.

SharePoint Advanced Management also provides organization-wide OneDrive permission snapshots, including guest permissions, sharing links, and items with broken inheritance. It is useful for exposure assessment but likewise does not reconstruct historical sharing or access.^10^

For future investigations, configure extended Purview retention or continuously export the Management Activity API feed to durable storage/SIEM.

References

1. Learn about auditing solutions in Microsoft Purview
2. Manage audit log retention policies
3. Search the audit log
4. Use sharing auditing in the audit log
5. Audit log activities
6. Search-UnifiedAuditLog-Syntax
7. Get-MgDriveItemChild-Syntax
8. List sharing permissions on a driveItem
9. Report on file and folder sharing in a SharePoint site
10. Get your organization's site permissions baseline with the snapshot report