Reference
OneDrive
All of your users OneDrives in your tenant
Part of the OneDrive inventory.
Scan settings
| Default scanning interval | Allowed scanning intervals | Data removal during incremental scan |
|---|---|---|
| Daily | Daily, Weekly, Bi-Weekly, Monthly, Never, Initial | Yes |
Properties
| Property | Type | Description | Automation placeholder |
|---|---|---|---|
| Initially Scanned | DateTime | Shows when this object was initially found in a scan. | {{OneDrive.CreatedTime}} |
| Description | String | Provide a user-visible description of the drive. | {{OneDrive.Description}} |
| Display Name | String | {{OneDrive.DisplayName}} | |
| File and Folder Count | Int64 | Total number of documents and folders inside drive | {{OneDrive.DocumentCount}} |
| Created Date | DateTime | Date and time of item creation. | {{OneDrive.DriveCreatedTime}} |
| Last modified | DateTime | Date and time the item was last modified. | {{OneDrive.DriveLastModifiedTime}} |
| Drive Type | String | Describes the type of drive represented by this resource. OneDrive personal drives will return personal. OneDrive for Business will return business. SharePoint document libraries will return documentLibrary. Allowed values: Business, DocumentLibrary, Personal. | {{OneDrive.DriveType}} |
| Geo Location | String | {{OneDrive.GeoLocation}} | |
| Last scan update | DateTime | Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change. | {{OneDrive.LastModifiedTime}} |
| Owner | User | Drives owned by the user | {{OneDrive.Owner}} |
| Owner Name | String | Drives owned by the user | {{OneDrive.OwnerName}} |
| Deleted | Int64 | Total space consumed by files in the recycle bin, in bytes | {{OneDrive.QuotaDeleted}} |
| Remaining | Int64 | Total space remaining before reaching the quota limit, in bytes | {{OneDrive.QuotaRemaining}} |
| State | String | Drive owned by the user Allowed values: critical, exceeded, nearing, normal. | {{OneDrive.QuotaState}} |
| Quota | Int64 | Total allowed storage space, in bytes | {{OneDrive.QuotaTotal}} |
| Used | Int64 | Total space used, in bytes | {{OneDrive.QuotaUsed}} |
| Used Percentage | Double | Total space used, in percent | {{OneDrive.QuotaUsedPercentage}} |
| Risk Score | Int32 | Stores risk score | {{OneDrive.RiskScore}} |
| Risk Score Update | DateTime | Stores risk score update | {{OneDrive.RiskScoreLastUpdate}} |
| Risk Score Value | String | Stores risk score value like Low_Low | {{OneDrive.RiskScoreValue}} |
| Id | String | Id of the SharePoint Site Collection the OneDrive is based on. | {{OneDrive.SiteId}} |
| Site Url | String | Url of the SharePoint Site Collection the OneDrive is based on. | {{OneDrive.SiteUrl}} |
| Library Url | String | URL that displays the resource in the browser. | {{OneDrive.WebUrl}} |
Relations
| Relation | Service | Description |
|---|---|---|
| User | Microsoft 365 | All users registered in your tenant (internal, external) |
| File | OneDrive | All OneDrive files stored in a library of a OneDrive |
| Folder | OneDrive | All OneDrive folders stored in a library of a OneDrive |
| File Sharing | OneDrive | All shared OneDrives items with their sharing information |
Segments
This object does currently not have any segments.
Actions
This object does currently not have any actions.
Policies that check this object
| Policy | Severity | Description |
|---|---|---|
| OneDrives near storage limit | High | Shows OneDrives using more than 90% of their available storage space |
| OneDrive contains files from disabled user accounts | Medium | Highlights OneDrive files stored in accounts that have been disabled, creating compliance and security concerns. |
| OneDrive contains at least one externally shared file | Medium | Identifies OneDrive accounts where at least one file is shared externally, posing potential data security risks. |
| Large OneDrive Sites | Medium | Show OneDrive Site with more than 100GB data |
| OneDrive belongs to a disabled user account | Medium | Finds OneDrive accounts linked to disabled user accounts that should be reassigned or deprovisioned. |