Reference

OneDrive

All of your users OneDrives in your tenant

Part of the OneDrive inventory.

Scan settings

Default scanning intervalAllowed scanning intervalsData removal during incremental scan
DailyDaily, Weekly, Bi-Weekly, Monthly, Never, InitialYes

Properties

Property Type Description Automation placeholder
Initially Scanned DateTime Shows when this object was initially found in a scan. {{OneDrive.CreatedTime}}
Description String Provide a user-visible description of the drive. {{OneDrive.Description}}
Display Name String {{OneDrive.DisplayName}}
File and Folder Count Int64 Total number of documents and folders inside drive {{OneDrive.DocumentCount}}
Created Date DateTime Date and time of item creation. {{OneDrive.DriveCreatedTime}}
Last modified DateTime Date and time the item was last modified. {{OneDrive.DriveLastModifiedTime}}
Drive Type String Describes the type of drive represented by this resource. OneDrive personal drives will return personal. OneDrive for Business will return business. SharePoint document libraries will return documentLibrary. Allowed values: Business, DocumentLibrary, Personal. {{OneDrive.DriveType}}
Geo Location String {{OneDrive.GeoLocation}}
Last scan update DateTime Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change. {{OneDrive.LastModifiedTime}}
Owner User Drives owned by the user {{OneDrive.Owner}}
Owner Name String Drives owned by the user {{OneDrive.OwnerName}}
Deleted Int64 Total space consumed by files in the recycle bin, in bytes {{OneDrive.QuotaDeleted}}
Remaining Int64 Total space remaining before reaching the quota limit, in bytes {{OneDrive.QuotaRemaining}}
State String Drive owned by the user Allowed values: critical, exceeded, nearing, normal. {{OneDrive.QuotaState}}
Quota Int64 Total allowed storage space, in bytes {{OneDrive.QuotaTotal}}
Used Int64 Total space used, in bytes {{OneDrive.QuotaUsed}}
Used Percentage Double Total space used, in percent {{OneDrive.QuotaUsedPercentage}}
Risk Score Int32 Stores risk score {{OneDrive.RiskScore}}
Risk Score Update DateTime Stores risk score update {{OneDrive.RiskScoreLastUpdate}}
Risk Score Value String Stores risk score value like Low_Low {{OneDrive.RiskScoreValue}}
Id String Id of the SharePoint Site Collection the OneDrive is based on. {{OneDrive.SiteId}}
Site Url String Url of the SharePoint Site Collection the OneDrive is based on. {{OneDrive.SiteUrl}}
Library Url String URL that displays the resource in the browser. {{OneDrive.WebUrl}}

Relations

Relation Service Description
User Microsoft 365 All users registered in your tenant (internal, external)
File OneDrive All OneDrive files stored in a library of a OneDrive
Folder OneDrive All OneDrive folders stored in a library of a OneDrive
File Sharing OneDrive All shared OneDrives items with their sharing information

Segments

This object does currently not have any segments.

Actions

This object does currently not have any actions.

Policy Severity Description
OneDrives near storage limit High Shows OneDrives using more than 90% of their available storage space
OneDrive contains files from disabled user accounts Medium Highlights OneDrive files stored in accounts that have been disabled, creating compliance and security concerns.
OneDrive contains at least one externally shared file Medium Identifies OneDrive accounts where at least one file is shared externally, posing potential data security risks.
Large OneDrive Sites Medium Show OneDrive Site with more than 100GB data
OneDrive belongs to a disabled user account Medium Finds OneDrive accounts linked to disabled user accounts that should be reassigned or deprovisioned.

Last updated: 7/19/2026