If you suspect that a user or an attacker downloaded hundreds of files from OneDrive in a short period, you need a method to confirm it. Microsoft Purview provides audit logs that capture every file download event, including the user, file name, timestamp, and client IP address. This article explains how to search Purview for … Read more
You see a DLP policy tip in OneDrive warning that a file contains sensitive information, yet the upload finishes without being blocked. This behavior is confusing because most users expect a DLP tip to prevent the upload entirely. The cause is that DLP policy tips in OneDrive are advisory by default — they inform but … Read more
Business users often store confidential documents in OneDrive without realizing the security risks. Files containing personally identifiable information, financial data, or trade secrets can be exposed if sharing settings are too permissive. Microsoft 365 provides built-in tools to scan OneDrive for sensitive content and flag files that need tighter access controls. This article explains how … Read more
When you apply a Microsoft 365 retention label to a file in OneDrive, the system blocks version cleanup operations on that file. This happens because retention labels enforce a legal hold or compliance rule that protects every version of the document from deletion. You might see errors in the version history panel or find that … Read more
When your organization receives a legal or compliance request, you must export specific OneDrive files and folders for review. Microsoft Purview eDiscovery tools can search and export content, but only if the data is properly indexed and accessible. Misconfigured sync settings, file exclusions, or retention policies can block successful exports. This article explains how to … Read more
When you run an audit search in the Microsoft 365 Purview compliance portal, you expect to see all user activities including file preview events from OneDrive. However, many administrators find that preview events such as FilePreviewed or Preview are missing from the audit log results. This happens because Microsoft does not log file preview activities … Read more
Business owners often ask how long their OneDrive files are kept and what happens when someone leaves the company. Microsoft 365 retention policies control whether files are deleted, kept as is, or held for legal reasons. These policies apply to OneDrive, SharePoint, and Exchange, but the rules for OneDrive are different from email or Teams … Read more
You are trying to share a file or folder from OneDrive with an external user, but the share action fails silently or shows an error about sensitivity labels. This happens because a sensitivity label applied to the file or folder includes a protection setting that blocks external sharing. Microsoft Purview Information Protection lets administrators configure … Read more
When you share files from OneDrive using an anonymous link, anyone with the link can access the file without signing in. This convenience can create compliance risks if sensitive data is shared outside your organization. IT administrators and compliance officers need a reliable method to audit and review these anonymous sharing links across their tenant. … Read more
You delete a file from OneDrive only to find it reappears minutes or hours later. This is not a sync glitch or a permissions error. The cause is a retention policy or legal hold applied to your OneDrive account by your organization’s compliance team. This article explains why legal hold overrides file deletion, how to … Read more