Monitor agent access to SharePoint and OneDrive

The agent access insights report provides SharePoint administrators with rich information on how the agents access content across all SharePoint and OneDrive sites in your organization. The report includes all registered and activated agents, such as:

By using this report, you can see how agents interact with your content, spot access patterns, and view agent distribution across sites. Use these insights to strengthen your security and apply governance controls like Restricted access control and Restricted content discovery.

Agent access insights use Microsoft 365 unified audit logs to track how agents access your SharePoint sites and OneDrive accounts. These logs capture signals like reading, searching, and interacting with content, giving you a clear view of agent activity.

You can generate and manage the agent access insights report in the SharePoint Admin Center or by using SharePoint Online Management Shell. You must have an appropriate role assigned, such as SharePoint administrator, to create or view agent access reports.

Before you begin

See SharePoint Advanced Management prerequisites.

Important

If you don't have a Microsoft SharePoint Advanced Management license, you're asked to enable data collection, so that the product starts to collect the relevant audit data to build this report. Once enabled, the reports can be generated 24 hours later and contain data from the point of collection. Data is stored for 28 days. If no reports are generated at least once in three months, data collection is paused and should be enabled again. To enable data collection for these reports, refer to the Data collection for agent access insights report section in this article.

How do I access the agent access insights report in the SharePoint admin center?

  1. Go to the SharePoint admin center and sign in.

  2. In the navigation pane, expand Reports, and then select Agent insights.

  3. Select Agent access.

  4. Review the report details, including agent activity, access patterns, and site distribution.

    Screenshot showing Agent Insights in the SharePoint admin center.

How to create agent access reports in the SharePoint admin center

Note

You can create reports for the past 1, 7, 14, or 28 days. Data older than 28 days is automatically rolled off.

  1. In the SharePoint admin center, in the navigation pane, expand Reports, and then select Agent insights.

  2. Select Create a report.

  3. Specify a name for the report and the report duration (1, 7, 14, or 28 days).

  4. Select Create and run (or Create).

    Screenshot showing how to create an agent access report in the SharePoint admin center.

View the agent access report status in the SharePoint admin center

  1. In the SharePoint admin center, in the navigation pane, expand Reports, and then select Agent insights.

  2. Check the Status column to see if a report is ready or when it was last updated.

    Screenshot showing a list of agent access reports.

View the agent access report details in the SharePoint admin center

  1. In the SharePoint admin center, in the navigation pane, expand Reports, and then select Agent insights.

  2. Check the Status column to see if a report is ready or when it was last updated.

  3. Select a report to view the data. You can view the top 100 sites hosting the highest number of agents. You can search for sites or filter by site template and governance policies.

    Screenshot showing agent distribution in SharePoint.

View top 20 agents for a specific site

  1. In the SharePoint admin center, in the navigation pane, expand Reports, and then select Agent insights.

  2. Select Agent access.

  3. Select a site to view the top 20 agents accessing the content across the selected site.

    Screenshot showing top agents for a specific SharePoint site in an agent insights report.

View agent distribution across sites

  1. In the SharePoint admin center, in the navigation pane, expand Reports, and then select Agent insights.

  2. Select Agent access.

  3. Choose Unique Agents found in SharePoint Sites or Unique Agents in OneDrive Account.

    This view displays how agents are distributed across your organization's sites. You can quickly see the number of sites in each site template category and how many unique agents are accessing them.

    Screenshot showing agent distribution across SharePoint sites.

Apply content governance policies from the access report

You can apply content governance policies on the sites from the access insights report. The available policies are:

Important

After you apply a policy to the site from the insights report, the policy status on the existing report doesn't update. To view the updated status of the policy on the site, select the policy to view the latest status or access the Active site panel and review the site settings.

Access the agent access insights report by using SharePoint Online Management Shell

You can generate, check, and manage agent access insights reports by using SharePoint Online Management Shell.

Prerequisites

Create and view an agent access insights report with SharePoint Online Management Shell

With permissions of at least a SharePoint administrator, you can generate and view the insights report by using the following commands:

  1. To generate a report for the default one-day report duration, run the following command:

    Start-SPOM365AgentAccessInsightsReport

    This command generates an agent access insights report for the past one day by default.

  2. You can specify a different duration (7, 14, or 28 days) by using the -ReportPeriodInDays parameter. For example, to create a report for the past 28 days, run:

    Start-SPOM365AgentAccessInsightsReport -ReportPeriodInDays <28>

  3. To check the status of all active and available reports, run the following command:

    Get-SPOM365AgentAccessInsightsReport

  4. To view the details of a specific report, run the following command:

    Get-SPOM365AgentAccessInsightsReport -ReportId <ReportId>

    Replace <ReportId> with the actual Report ID obtained from the previous command.

  5. To download and view the report, run the following command:

    Export-SPOM365AgentAccessInsightsReport -ReportId <ReportId> -Action Download

    Note

    PowerShell displays up to 100 sites but downloaded reports can contain up to 1 million sites.

    Export-SPOM365AgentAccessInsightsReport -ReportId <ReportId> -View Download

    Replace <ReportId> with the actual Report ID.

  6. You can also view summarized insights of agents across all site types by running the following command:

    Get-SPOM365AgentAccessInsightsReport –ReportId -Content SiteDistribution

    SiteDistribution provides the summarized view of agents across all types of sites like Communication sites, Microsoft 365 group connected sites, OneDrive accounts, and more.

Data collection for agent access insights report

If you don't have a Microsoft SharePoint Advanced Management license, you need to enable data collection. This section explains how to enable and check the status of data collection for the agent access insights report.

Enable data collection

The following PowerShell command starts collecting audit data for reports on activities from the previous day:

Start-SPOAuditDataCollectionForActivityInsights –ReportEntity M365AgentInsights

Check data collection status

After you enable data collection, you can generate the reports after 24 hours. To check whether you can generate reports, use the following PowerShell command:

Get-SPOAuditDataCollectionStatusForActivityInsights -ReportEntity M365AgentInsights

This command returns the current data collection status, which can be NotInitiated, InProgress, or Paused. You can generate reports when the status is InProgress.

Known experiences with Microsoft 365 agent access insights

Keep these important known experiences in mind when working with agent access insights reports in the SharePoint admin center or SharePoint Online Management Shell:

  • You can run a report only after 24 hours pass since the last report generation.
  • For large tenants, it can take up to 48 hours for data to become available.
  • Only one report can exist for each report range value (1, 7, 14, or 28 days). This limitation means you can see a maximum of four reports at any given point.
  • When you generate a new report for the same date range, it replaces the previous report. To keep the old report, download it before creating a new one.
  • Reports use Microsoft 365 unified audit data, which might not include every audit event.
  • Last updated on