Monitoring SharePoint: drift, usage, health

The signals that matter

Not everything is worth watching. The high-signal set:

1. Tenant sharing/security drift. Get-SPOTenant properties — SharingCapability, DefaultSharingLinkType, anonymous-link expiry, domain lists (tenant-sharing concept). These are org-wide, rarely reviewed, and a regression to permissive is the security event that matters most. Snapshot nightly, diff, alert on change.
2. Storage growth. The tenant pool vs usage and per-site hogs (Get-SPOSite | sort StorageUsageCurrent) — now that 2026 geo-based billing puts a price on it (storage-model concept), growth trends are a cost signal, not just capacity.
3. Site and guest count growth. New sites (sprawl) and new guests (external surface) trending up — the governance backlog forming in real time.
4. Oversharing posture. SAM data-access-governance report deltas (oversharing runbook) — org-wide links and broad ACLs appearing.

The audit-log leg (who did what)

The unified audit log carries the SharePoint operations that explain incidents:

• SharingSet, AnonymousLinkCreated, SecureLinkCreated, AddedToGroup — sharing and access-grant events.
• SharingInvitationAccepted — a guest redeeming access.
• Site/permission changes and file activity for forensic timelines.

These answer "when and by whom did this become shared" — the counterpart to the config snapshot's "what is shared now".

The change-intelligence loop

Config snapshot + audit stream + service health, on a schedule, is the loop:

1. Snapshot the config nightly (Get-SPOTenant, Get-SPOSite roll-ups).
2. Canonicalise and diff against yesterday.
3. Alert on the deltas that matter (a sharing setting loosened, a new FullControl app, storage crossing a threshold) as dated drift, not a dashboard nobody reads.
4. Correlate with the audit log to attribute the change.

The failure modes

• Dashboards nobody watches. A live admin-center page is not monitoring; monitoring is a diff that pushes an alert when something changes. Snapshot-and-diff beats staring at a portal.
• Audit-log retention limits. The unified log retains events for a bounded window (longer on higher tiers) — assuming a two-year-old event is queryable is a trap; export what you must keep.
• Latency in signals. Audit events and report data have ingestion lag; "it happened but isn't in the log yet" is normal for a short window.
• No baseline = no drift. Without a stored previous state you can only see "now", never "changed" — the baseline is the whole point.
• Service health blindness — Microsoft-side incidents (below the abstraction line) explain outages you can't fix; watch the service-health advisories, don't chase a phantom config bug.

What to watch (proofs)

• The versioned config: Get-SPOTenant | fl and Get-SPOSite -Limit All roll-ups snapshotted nightly — the baseline that makes drift visible.
• Drift alerts: a dated diff of the sharing/security properties — the alert that fires when posture regresses.
• Audit queries: the unified audit log filtered to SharingSet / AnonymousLinkCreated / AddedToGroup — who changed access and when.
• Health leg: the Microsoft 365 service-health advisories for SharePoint — the below-the-line window that explains what isn't yours to fix.