How to Find Which Administrator Granted Access to a OneDrive Account
Question details
Identify which administrator was granted or assigned themselves access as a site collection administrator to another user's OneDrive account.
- Product
- OneDrive / Microsoft Purview
- Device & OS
- not provided
- Scenario
- Auditing administrator actions and monitoring unauthorized or authorized access delegations within an organization's OneDrive environment.
- Observed behavior
- Users need to track specific site collection administrator additions using Microsoft Purview audit logs to determine the account, time, and related access operations.
Ensure you have the appropriate Microsoft 365 permissions (such as the Audit Logs or View-Only Audit Logs role) to search the Microsoft Purview compliance portal.
Search Microsoft Purview Audit Logs for Administrator Changes
Use the Microsoft Purview compliance portal to track the 'Added site collection administrator' activity and identify who granted the access.
Microsoft Purview records administrative actions across Microsoft 365 services. When an admin grants access to a OneDrive account, it is logged as a site collection administrator change.
Log in to the Microsoft Purview compliance portal using your administrator credentials.
On the left navigation pane, click on 'Audit' to open the audit log search tool.
Set your desired date and time range. In the 'Activities' search box, look for and select 'Added site collection administrator'.
Click 'Search' to run the query. Once the results load, click on individual events to view details such as the administrator who performed the action, the affected account, and the exact timestamp.
Manage and Create Documents Securely with WPS Office
While managing OneDrive server-side audits requires Microsoft 365 administrative tools, you don't need an expensive subscription for your daily document creation and editing. WPS Office is a lightweight, secure, and highly compatible alternative that meets all your productivity needs.
- 1. Download the software: Visit the official WPS website and download the free WPS Office installer.
- 2. Install WPS Office: Run the installer and follow the on-screen prompts to set up the suite on your device.
- 3. Open your files directly: Launch WPS Office and open your existing Microsoft Office documents seamlessly without changing file formats.
Frequently Asked Questions
Why can't I see any results for the 'Added site collection administrator' activity?
Audit logging might not be enabled for your organization, or the event may have occurred outside of your configured audit data retention period. Additionally, logs can take some time to process and appear.
Who has permission to view Microsoft Purview audit logs?
Only administrators with specific role assignments, such as Global Administrators or those assigned the Audit Logs or View-Only Audit Logs roles in Exchange Online, can access and search the audit logs.
How long are OneDrive administrative audit logs kept?
The retention period depends on your organization's Microsoft 365 subscription. Standard retention is typically 90 days, while advanced auditing licenses can retain logs for up to one year or longer.
