Report on files accessed through OneDrive for Business

Question

We recently enabled OneDrive for Business where our users on Sharepoint Online can connect to our library with OneDrive.

Microsoft Admin Center has basic reporting on OneDrive (personal usage from what I can gather) and Sharepoint (I believe "synced" is the indicator that shows OneDrive for Business was used to interact with files on Sharepoint, but I'm welcome to be corrected on this one)

The usage report needs to include some specifics about files being accessed. So I can't use the beta Graph API for this exclusively.

I've enabled Audit logging on the Sharepoint site, and can, with the Classic Search on the Audit Log get the results we're after (mostly). I've found this resource: https://techcommunity.microsoft.com/t5/security-compliance-and-identity/microsoft-365-compliance-audit-log-activities-via-o365/ba-p/2957297

That details pretty much what we would need to implement this in our own reporting software.

I'm just wondering if anyone with reporting experience in Sharepoint Online (that users use through OneDrive or Sharepoint site) can tell me if I'm on the right track?

Basics of what I need:

• How many users are using only OneDrive? (I guess we can't determine this because the OneDrive stats available is for their personal cloud storage and not Sharepoint)
• Which file types do they interact with/upload/download most/how often
• Opening of folders (which I don't think is audited at all from what I can see, but still a nice to have)

Thank you in advance!

Answer 1

• Yes we can't, the storage path is a personal act, the storage way is just the foothold of the storage path.
• You can choose to share/upload/download files in the audit log, but to analyze the interaction frequency of different file types, you also need to download the report for manual screening and analysis. In addition, in the site usage, you can view popular files for a period of time (7/30/90 days), and the number of visitors will be displayed, but the type also will not be distinguished.
• It should be mentioned that the audit log has periodic updates to site activities, that is, some actions on the file will take a period of time to be fed back to the audit log.