How to Audit File Sharing Activities in Microsoft Teams

In the ever-expanding tech era, team channels are one of the most widely used features for collaboration among groups of users in Microsoft Teams. They streamline communication, centralize discussions, and most importantly, facilitate seamless file sharing across teams in Microsoft Teams. Files from SharePoint, OneDrive, and local devices can be effortlessly shared with channel members, enhancing productivity and teamwork.

But here’s the challenge: Files can be shared in teams without any approval or oversight, potentially leading to unauthorized access and data leaks. Imagine a confidential document being shared in a public or guest-accessible channel without anyone realizing it😨. That’s why auditing file-sharing activities in Microsoft Teams channels isn’t just important—it’s essential.

In this guide, let’s explore how to track file sharing activities in Microsoft Teams channels, helping you spot security risks, enforce compliance, and maintain control over your organization’s data before it’s too late.

Unfortunately, Microsoft doesn’t provide a straightforward way to track all sharing activities across Teams channels. To find shared files in MS Teams, you’ll need to go through SharePoint Online sharing activity reports for SharePoint files, OneDrive reports for OneDrive files, and so on.

Alternatively, you could manually search through individual channels across multiple teams to audit file-sharing activities. Regardless of the method, the challenge remains the same—both are tedious and time-consuming processes.

That’s why we’ve developed a PowerShell script that does the heavy lifting for you. Now, you can retrieve all shared files in channels effortlessly without the manual hassle!

Download Script: AuditTeamsFileSharingActivities.ps1

1. The script automatically verifies and installs the Exchange Online PowerShell module (if not already installed) upon your confirmation.
2. Tracks all file sharing activities in Microsoft Teams Channels across your tenant.
3. Finds files shared by external users in Microsoft Teams.
4. The script can be executed with an MFA-enabled account as well.
5. Finds files shared in a specific team and channel.
6. It exports the report result to CSV format.
7. It can be executed with Certificate-based Authentication too.
8. The script is scheduler friendly.

Here’s a sample exported report showing files shared in Microsoft Teams channels.

The exported report contains Shared Time, Team Name, Channel Name, Shared File, Shared By, File Extension, Shared File URL, and other Audit Info.

1. Download the script.
2. Start the Windows PowerShell.
3. Select any of the methods provided to execute the script.

Method 1: Execute the script with an MFA or non-MFA account.

This script generates the audit report of all files shared in your organization through MS Teams channels over the past 180 days.

Method 2: Execute the script by explicitly mentioning credentials.

The above method supports only non-MFA accounts. If the admin account has MFA, you need to disable MFA using CA policy to make this work.

Method 3: Execute the script using certificate-based authentication.

To use certificate-based authentication, you must register the app in Entra ID which helps you to connect Exchange Online using the certificate.

You can also schedule this script using Task Scheduler or Azure Automation to periodically export shared files in Teams.

Depending on the requirements, you can use either CA certificates or create self-signed certificates.

User requirements are often specific, demanding precise solutions. To address this, we have developed this PowerShell script with filters designed to meet your refined needs for tracking file sharing activities in Microsoft Teams channels.

Below are the use cases where this script can be leveraged to get all shared files.

1. Track files shared by external users in Microsoft Teams
2. Get all file sharing activities within a specific timeframe
3. Audit all shared files report in a team
4. Find all files shared in a specific channel
5. Audit file sharing more granularly in Microsoft Teams

Auditing files shared by external users in Teams is crucial to ensure your organization remains protected from spam, malware, or malicious files. However, manually identifying all teams & channels with external users and tracking files shared in them can be an overwhelming and time-intensive task.

To streamline this process, run the script with -ByExternalUsersOnly parameter to audit file sharing activities by external users in teams.

The above format tracks all files shared by guest users in Microsoft Teams channels.

By default, this script retrieves all file-sharing activities in Microsoft Teams for the last 180 days. However, if the output contains too much data, tracking files shared within a specific date or time frame can become challenging.

In such cases, you can run the script with -StartDate and -EndDate parameters to reduce the script execution time and narrow down the search results.

The above command retrieves all files shared between February 15, 2025, and March 30, 2025.

Unmonitored file sharing in teams with external users can lead to compliance issues and data leaks. Once shared, these files can be downloaded, edited, and further distributed without control. To prevent these risks, always track file-sharing activities in teams with guest or external users.

Run the script using the -TeamName parameter to get a detailed report of all file-sharing activities in a specific team within your organization.

The above format gets all files shared in the team ConsultingVendors in the last 180 days.

Shared channels in Microsoft Teams make collaboration seamless by allowing members outside the team to join conversations. However, this also means that files shared within these channels can be accessed by anyone added to the channel, even if they are not part of the team.

To prevent unintended data exposure, it’s crucial to regularly audit file-sharing logs in these channels. This ensures that only necessary files are shared, and that sensitive information remains protected.

Run the script with the -ChannelName parameter to track file-sharing activities in a specific channel.

The above script retrieves all file-sharing activity logs for the channel VendorsDiscussion in the ConsultingVendors team.

So far, we’ve explored valuable insights into file-sharing activities. But what if you need to track files shared by external users in a specific team or channel?

You can do this by combining multiple parameters. Let’s look at a few scenarios:

• To get the file-sharing activities of external users in a specific team, run the script as below.
  
  .\AuditTeamsFileSharingActivities.ps1 -TeamName “ConsultingVendors” -ByExternalUsersOnly

  1	.\AuditTeamsFileSharingActivities.ps1 -TeamName “ConsultingVendors” -ByExternalUsersOnly

  
  This exports all files shared by external users in the ConsultingVendors team.
• To audit the file-sharing activity log of external users in a specific team channel, use the execution below.
  
  .\AuditTeamsFileSharingActivities.ps1 -TeamName “ConsultingVendors” -ChannelName “VendorsDiscussion” -ByExternalUsersOnly

  1	.\AuditTeamsFileSharingActivities.ps1 -TeamName “ConsultingVendors” -ChannelName “VendorsDiscussion” -ByExternalUsersOnly

  
  This retrieves all files shared by external users in the channel VendorsDiscussion over the last 180 days.
• To track file-sharing activities in a team within a specific date range, run the script as shown below.
  
  .\AuditTeamsFileSharingActivities.ps1 -TeamName “ConsultingVendors” -StartDate 01/22/2025 -EndDate 03/25/2025

  1	.\AuditTeamsFileSharingActivities.ps1 -TeamName “ConsultingVendors” -StartDate 01/22/2025 -EndDate 03/25/2025

  
  This extracts file-sharing logs from January 22, 2025, to March 25, 2025, in the ConsultingVendors team.

Similarly, you can mix and match parameters to filter the file sharing audit report exactly how you need, whether by external users, specific dates, or both. The more parameters you combine, the more precise your search results will be!

Tips:

• Asks users to report suspicious messages in Microsoft Teams, especially if they see something unusual in the files shared by external users in chats, to reduce the attack surface.
• Prevent users from sharing sensitive files in Microsoft Teams channels or chats by applying a DLP policy for Microsoft Teams.

In conclusion, we hope this blog has provided valuable insights into tracking file-sharing activities in Microsoft Teams. By auditing file sharing activities reports, you can ensure that sensitive files are only accessible to the right people, reducing the risk of unintended data exposure. If you have any questions or thoughts, don’t hesitate to drop them in the comments section!