Once audit logging has been enabled, events should begin appearing for activities. With regards to SharePoint and OneDrive sharing activity, items will have the following properties that are available for examination:
- TargetUserOrGroupType: This identifies the object type of the target being shared (valid options are Member, Guest, SharePointGroup, SecurityGroup, and Partner).
- TargetUserOrGroupName: This displays the identity of the object a resource was shared with.
- AuditData: This stores information about sharing events.
- Sharing Events: The following event activities will go into the audit data:
- SharingInvitationCreated: A user tried to share a resource.
- SharingInvitationAccepted: The user has accepted a sharing invitation. ...