Purview Alert Does Not Identify the OneDrive Path: OneDrive for Business Fix

When a Microsoft Purview alert fires for a sensitive file stored in OneDrive for Business, the alert details often fail to show the full OneDrive path. Instead, you might see a generic SharePoint URL or a truncated location that makes it difficult to locate the exact file. This happens because Purview maps OneDrive sites as SharePoint site collections, and the alert generation process does not always resolve the user-specific path correctly. This article explains why the OneDrive path is missing from Purview alerts and provides the exact steps to identify the correct path using Microsoft 365 admin tools.

Why Purview Alerts Show an Incomplete OneDrive Path

Microsoft Purview treats each user's OneDrive for Business site as a SharePoint site collection with a URL format like https://yourtenant-my.sharepoint.com/personal/user_domain_com. When an alert is triggered by a data loss prevention policy or a sensitive information type match, Purview records the file location using the underlying SharePoint object model. The alert details in the compliance portal display the site collection URL but often omit the user-specific path that identifies the OneDrive owner. This truncation occurs because the alert schema stores the site ID rather than the full web URL, and the user interface does not always resolve the site ID back to a user-friendly OneDrive path. As a result, the alert shows a generic SharePoint URL instead of the user-specific /personal/ path, making it unclear which user's OneDrive contains the flagged file.

Steps to Locate the OneDrive Path from a Purview Alert

Follow these steps to extract the correct OneDrive path from a Purview alert that shows only a partial SharePoint URL. You will use the Microsoft 365 admin center and the SharePoint Online Management Shell to map the alert data to the user's OneDrive site.

1. Open the Purview alert details
   Sign in to the Microsoft Purview compliance portal at https://compliance.microsoft.com. Go to Alerts and click the alert that is missing the OneDrive path. In the alert details pane, locate the Activity list section. The file URL displayed here ends with the document name but the path portion stops at the root SharePoint URL, for example, https://yourtenant-my.sharepoint.com/Shared%20Documents/Report.docx. Note the user principal name (UPN) or email address shown in the alert metadata. This is the user whose OneDrive contains the file.
2. Find the user's OneDrive URL in the admin center
   Open the Microsoft 365 admin center at https://admin.microsoft.com. Go to Users > Active users and select the user identified in the alert. In the user details pane, click the OneDrive tab. The OneDrive URL field displays the user's full OneDrive site URL, for example, https://yourtenant-my.sharepoint.com/personal/john_doe_contoso_com. Copy this URL.
3. Combine the OneDrive URL with the file path from the alert
   Take the user's OneDrive URL from step 2 and append the file path from the alert's activity list. The alert shows the file name and the folder path relative to the document library root. For example, if the alert shows /Shared%20Documents/Report.docx, the full path becomes https://yourtenant-my.sharepoint.com/personal/john_doe_contoso_com/Shared%20Documents/Report.docx. This is the complete OneDrive path that Purview should have displayed.
4. Verify the path using SharePoint Online Management Shell (optional)
   If the admin center does not show the OneDrive URL, use the SharePoint Online Management Shell. Install the module if needed with Install-Module -Name Microsoft.Online.SharePoint.PowerShell. Connect to your tenant: Connect-SPOService -Url https://yourtenant-admin.sharepoint.com. Run Get-SPOSite -IncludePersonalSite $true -Filter "Url -like '/personal/" | Where-Object {$_.Owner -eq 'user@domain.com'} to retrieve the user's OneDrive site URL. Use this URL to reconstruct the full file path as described in step 3.

If the Alert Still Shows a Generic SharePoint URL

Purview alert shows a site collection URL instead of a user path

Some alerts display the root site collection URL for the OneDrive tenant, such as https://yourtenant-my.sharepoint.com, without any user-specific segment. In this case, the alert metadata includes a User or Affected user field. Use the user's email address to look up their OneDrive URL in the admin center as described in step 2 above. The root URL plus the user path gives you the correct site. If the alert does not list a user, check the Activity tab for the UserId property. This property contains the UPN of the user who performed the action that triggered the alert.

Multiple files from different OneDrive sites appear in one alert

A single Purview alert can aggregate activities from multiple users. The alert details pane lists each file in the activity list with a separate entry. Each entry shows the file URL and the user who acted on it. You must repeat the lookup process for each user to get the correct OneDrive path for each file. Use the user identifier from each activity row to find the corresponding OneDrive URL in the admin center.

The OneDrive tab is missing in the admin center for some users

If the OneDrive tab does not appear for a user in the Microsoft 365 admin center, the user may not have a OneDrive site provisioned yet. A OneDrive site is created automatically when a user first accesses OneDrive or when an administrator provisions it via PowerShell. Use the SharePoint Online Management Shell with the command Request-SPOPersonalSite -UserEmails user@domain.com to provision the site. After the site is created, wait a few minutes and then repeat the admin center lookup.

Purview Alert Path vs Actual OneDrive Path: Key Differences

Item	Purview Alert Path	Actual OneDrive Path
URL format	Root SharePoint URL or site collection ID	User-specific /personal/ path
User identification	UPN in alert metadata	Embedded in the URL path
Example	https://tenant-my.sharepoint.com/Shared Documents/file.docx	https://tenant-my.sharepoint.com/personal/user_domain_com/Shared Documents/file.docx
How to retrieve	From alert details pane	Admin center OneDrive tab or PowerShell

You can now reconstruct the full OneDrive path for any Purview alert by cross-referencing the alert metadata with the user's OneDrive URL from the admin center. Next, consider creating a custom Purview alert rule that includes the user's OneDrive URL in the alert email notification by using the Custom properties option in the data loss prevention policy. For advanced automation, use the Purview audit log export to CSV and a PowerShell script that appends the OneDrive URL to each alert record.