Account Was Compromised. Can I see if someone viewed my one drive files?

Yes, you can view the activity related to your OneDrive files, especially if you suspect that your account has been compromised. Microsoft 365 provides activity reports that can help you understand how your OneDrive account has been used.

To check the activity of your OneDrive files, you can access the OneDrive activity report in the Microsoft 365 admin center. This report will show you various metrics, including:

• The last activity date for files in your OneDrive.
• The number of files viewed or edited.
• Any files that have been shared internally or externally.

To access the OneDrive activity report, follow these steps:

1. In the admin center, go to the Reports > Usage page.
2. Select the OneDrive button in the left navigation.
3. You can view activities in the report by choosing the Activity tab.

This report can help you identify if any unauthorized access has occurred and which files were accessed during that time.

Additionally, if you want to investigate further, you can perform an audit log search to find specific activities related to your OneDrive account, including sign-ins and file access.

References:

• Microsoft 365 Reports in the admin center - OneDrive activity
• Interpret the OneDrive activity report