Table: microsoft365_drive - Query Microsoft 365 Drives using SQL

Microsoft 365 Drive is a component of Microsoft 365 that provides cloud storage for individual users and organizations. It allows users to store files and personal data like Windows settings or BitLocker recovery keys in the cloud, share files, and sync files across Android, Windows Phone, and iOS mobile devices, Windows and macOS computers, and the Microsoft 365 website. Microsoft 365 Drive is designed to enable users to store, sync, and share work files.

Table Usage Guide

The microsoft365_drive table provides insights into individual drives within the Microsoft 365 ecosystem. As a cloud administrator or IT professional, explore drive-specific details through this table, including drive properties, usage patterns, and associated metadata. Utilize it to uncover information about the drives, such as their total size, used space, owner details, and the verification of sharing capabilities.

Important Notes

• You must specify the user_id in the where or join clause (where user_id=, join microsoft365_drive d on d.user_id=) to query this table.

Examples

Basic info

Explore which drives are tied to a specific user within your Microsoft 365 environment, allowing you to better manage and monitor user data storage. This is particularly useful for IT administrators who need to keep track of individual user activities and storage usage.

select
  name,
  id,
  drive_type,
  created_date_time,
  web_url
from
  microsoft365_drive
where
  user_id = 'test@org.onmicrosoft.com';

select
  name,
  id,
  drive_type,
  created_date_time,
  web_url
from
  microsoft365_drive
where
  user_id = 'test@org.onmicrosoft.com';

List personal drives

Explore which personal drives are associated with a specific user in Microsoft 365. This can be useful to understand a user's data storage and management habits.

select
  name,
  id,
  drive_type,
  created_date_time,
  web_url
from
  microsoft365_drive
where
  user_id = 'test@org.onmicrosoft.com'
  and drive_type = 'personal';

select
  name,
  id,
  drive_type,
  created_date_time,
  web_url
from
  microsoft365_drive
where
  user_id = 'test@org.onmicrosoft.com'
  and drive_type = 'personal';

List drives older than 90 days

Explore which drives in Microsoft 365 are older than 90 days to manage storage and ensure relevant data is archived or deleted. This is particularly useful for maintaining a clean and efficient storage system within a specific user account.

select
  name,
  id,
  drive_type,
  created_date_time,
  web_url
from
  microsoft365_drive
where
  user_id = 'test@org.onmicrosoft.com'
  and created_date_time <= current_date - interval '90 days';

select
  name,
  id,
  drive_type,
  created_date_time,
  web_url
from
  microsoft365_drive
where
  user_id = 'test@org.onmicrosoft.com'
  and created_date_time <= date('now', '-90 day');

List drives using the filter

Explore which drives were created under a specific user account and identify instances where the drive name matches 'Steampipe'. This can be useful for managing and organizing your Microsoft365 drives.

select
  name,
  id,
  drive_type,
  created_date_time,
  web_url
from
  microsoft365_drive
where
  user_id = 'test@org.onmicrosoft.com'
  and filter = 'name eq ''Steampipe''';

select
  name,
  id,
  drive_type,
  created_date_time,
  web_url
from
  microsoft365_drive
where
  user_id = 'test@org.onmicrosoft.com'
  and filter = 'name eq ''Steampipe''';

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- microsoft365

You can pass the configuration to the command with the --config argument:

steampipe_export_microsoft365 --config '<your_config>' microsoft365_drive