📁 Recipe · SharePoint & OneDrive
Search for Files Across Microsoft 365 and Review Their Sharing Permissions
Use Microsoft Graph Search to locate files by keyword across OneDrive and SharePoint, then audit their sharing links and permissions
Complexity
Intermediate
Impact
discovery + security-audit + access-review + read-only
Context
Why This Matters
IT admins frequently need to locate a specific document somewhere in the tenant — a policy, a config export, a contract — and determine who has access to it. When an end user says "I can't find the VPN setup doc" or "can you check who can see this file?", the admin needs a repeatable way to search across OneDrive and SharePoint, surface the best matches, and inspect the sharing posture.
This recipe uses the Microsoft Graph Search API and drive item permissions endpoints to find files by keyword and return locations, owners, and sharing links. It is useful for access troubleshooting, shadow-sharing audits, eDiscovery triage, and incident response where a sensitive keyword might be exposed via an anonymous link.
Expected Outcomes
After running this recipe you will have:
- A ranked list of files matching your search keyword(s) across the tenant
- File metadata: owner, last modified, URL, and parent site/drive
- A complete permissions inventory for any chosen match — direct grants, sharing links, and link scopes (anonymous, organization, specific people)
- Actionable recommendations: whether to tighten a link, move the file to a managed SharePoint site, or grant explicit access to a requesting user
Risks & Considerations
Before you run this:
- Scope matters.
/search/queryrequiresFiles.Read.AllorSites.Read.Allas an app/delegated permission. Without these, results will silently return empty — which can be mistaken for "file doesn't exist". - GET vs POST. The tenant-wide Search API (
/search/query) requiresPOSTwith a JSON body.GET /drive/root/search(q='...')only searches the caller's own OneDrive, not the whole tenant. - Anonymous links are a leak risk. If a permissions check reveals
scope: anonymous, treat it as a finding — especially for files named with sensitive keywords (VPN, SSH, password, salary). - Don't modify permissions without approval. This recipe is read-only. Revoking a sharing link can break active workflows — always confirm with the file owner before removing links.
- Keyword results are relevance-ranked, not exhaustive. A file may not appear if it hasn't been indexed yet (typically ≤15 min after upload).
Required Permissions
| Permission | Why It's Needed |
|---|---|
| Files.Read.All | Required to search drive items across all users' OneDrive and SharePoint |
| Sites.Read.All | Required to enumerate SharePoint sites and search site document libraries |
| Files.ReadWrite.All | Optional — only needed if you plan to modify sharing links or grant new permissions as a follow-up action |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
For End Users
How an employee would ask Dex for help
Find a file and review its sharing via the admin GUI
Step 1 — Open the Microsoft 365 Admin Center
Navigate to to reach the SharePoint admin center, or sign in to as a global/SharePoint admin.
Step 2 — Run a tenant-wide search
- From the Office home page, use the top search bar and type your keyword (e.g.,
VPN). - Press Enter. Microsoft Search will return matches across your OneDrive, shared items, SharePoint sites, and Teams files you have access to.
- Click the Files filter on the left to narrow results to documents.
Note: As a regular admin, you only see files you personally have access to. To search files across all users, use the Content Search tool in the Microsoft Purview compliance portal: . Scope it to SharePoint sites and OneDrive, add your keyword as the query, and run it.
Step 3 — Open a matching file and review sharing
- Click the file to open it in its native location (SharePoint or OneDrive web).
- Click Share in the top-right, then the … menu › Manage access.
- Review three sections:
- Links — any sharing links, their scope (Anyone / People in your org / Specific people), and whether they allow edit.
- Direct access — users and groups explicitly granted access.
- Groups — site or Teams groups that inherit access.
Step 4 — Take action
If an anonymous ("Anyone with the link") link exists on a sensitive file, click the X next to it to revoke. To grant a requesting user access, add them via Grant access and choose Can view or Can edit.
Search and audit permissions via Microsoft Graph
1. Tenant-wide search (requires app permissions)
Use the unified Search API with POST and a JSON body. The endpoint is /v1.0/search/query.
POST https://graph.microsoft.com/v1.0/search/query
Content-Type: application/json
Authorization: Bearer <token>
{
"requests": [{
"entityTypes": ["driveItem"],
"query": { "queryString": "VPN" },
"from": 0,
"size": 25
}]
}The response returns hitsContainers[0].hits[], each with a resource object containing name, webUrl, parentReference (driveId + siteId), createdBy, and lastModifiedDateTime.
2. Narrower search (if you already know the user or site)
For a single user's OneDrive, a simple GET works:
GET /v1.0/users/{userPrincipalName}/drive/root/search(q='VPN')For a specific SharePoint site:
GET /v1.0/sites/{siteId}/drive/root/search(q='VPN')3. Inspect permissions on a match
Using driveId and itemId from the search hit:
GET /v1.0/drives/{driveId}/items/{itemId}/permissionsResponse: an array of permission objects. Key fields to evaluate:
roles—owner,write, orreadlink.scope—anonymous(⚠ external),organization, oruserslink.type—vieworeditgrantedToIdentitiesV2[]— specific users/groups on the link
4. (Optional) Revoke a risky link
DELETE /v1.0/drives/{driveId}/items/{itemId}/permissions/{permissionId}Automate search + permissions audit with PowerShell
The script below uses the Microsoft Graph PowerShell SDK. Install once: Install-Module Microsoft.Graph -Scope CurrentUser.
What the script does
- Connects to Graph with
Files.Read.AllandSites.Read.Allscopes. - Runs a tenant-wide
POST /search/queryfor your keyword(s). - For each hit, calls the permissions endpoint and flags any anonymous links.
- Outputs a structured object (or CSV with
-ExportCsv) listing file name, owner, URL, permission roles, and a risk flag for anonymous sharing.
Usage
# Basic search
.\Search-M365Files.ps1 -Keyword "VPN"
# Search with multiple keywords and export to CSV
.\Search-M365Files.ps1 -Keyword "VPN OR WireGuard OR OpenVPN" -ExportCsv ".\vpn-files.csv"
# Flag only files with anonymous sharing links
.\Search-M365Files.ps1 -Keyword "salary" -OnlyRiskyThe -OnlyRisky switch filters output to files with link.scope = anonymous — useful for quarterly shared-link audits.
Next steps