turbot/microsoft365
steampipe plugin install microsoft365

Table: microsoft365_drive - Query Microsoft 365 Drives using SQL

Microsoft 365 Drive is a component of Microsoft 365 that provides cloud storage for individual users and organizations. It allows users to store files and personal data like Windows settings or BitLocker recovery keys in the cloud, share files, and sync files across Android, Windows Phone, and iOS mobile devices, Windows and macOS computers, and the Microsoft 365 website. Microsoft 365 Drive is designed to enable users to store, sync, and share work files.

Table Usage Guide

The microsoft365_drive table provides insights into individual drives within the Microsoft 365 ecosystem. As a cloud administrator or IT professional, explore drive-specific details through this table, including drive properties, usage patterns, and associated metadata. Utilize it to uncover information about the drives, such as their total size, used space, owner details, and the verification of sharing capabilities.

Important Notes

  • You must specify the user_id in the where or join clause (where user_id=, join microsoft365_drive d on d.user_id=) to query this table.

Examples

Basic info

Explore which drives are tied to a specific user within your Microsoft 365 environment, allowing you to better manage and monitor user data storage. This is particularly useful for IT administrators who need to keep track of individual user activities and storage usage.

select
name,
id,
drive_type,
created_date_time,
web_url
from
microsoft365_drive
where
user_id = 'test@org.onmicrosoft.com';
select
name,
id,
drive_type,
created_date_time,
web_url
from
microsoft365_drive
where
user_id = 'test@org.onmicrosoft.com';

List personal drives

Explore which personal drives are associated with a specific user in Microsoft 365. This can be useful to understand a user's data storage and management habits.

select
name,
id,
drive_type,
created_date_time,
web_url
from
microsoft365_drive
where
user_id = 'test@org.onmicrosoft.com'
and drive_type = 'personal';
select
name,
id,
drive_type,
created_date_time,
web_url
from
microsoft365_drive
where
user_id = 'test@org.onmicrosoft.com'
and drive_type = 'personal';

List drives older than 90 days

Explore which drives in Microsoft 365 are older than 90 days to manage storage and ensure relevant data is archived or deleted. This is particularly useful for maintaining a clean and efficient storage system within a specific user account.

select
name,
id,
drive_type,
created_date_time,
web_url
from
microsoft365_drive
where
user_id = 'test@org.onmicrosoft.com'
and created_date_time <= current_date - interval '90 days';
select
name,
id,
drive_type,
created_date_time,
web_url
from
microsoft365_drive
where
user_id = 'test@org.onmicrosoft.com'
and created_date_time <= date('now', '-90 day');

List drives using the filter

Explore which drives were created under a specific user account and identify instances where the drive name matches 'Steampipe'. This can be useful for managing and organizing your Microsoft365 drives.

select
name,
id,
drive_type,
created_date_time,
web_url
from
microsoft365_drive
where
user_id = 'test@org.onmicrosoft.com'
and filter = 'name eq ''Steampipe''';
select
name,
id,
drive_type,
created_date_time,
web_url
from
microsoft365_drive
where
user_id = 'test@org.onmicrosoft.com'
and filter = 'name eq ''Steampipe''';

Schema for microsoft365_drive

NameTypeOperatorsDescription
_ctxjsonbSteampipe context in JSON form.
created_byjsonbIdentity of the user, device, or application which created the item.
created_date_timetimestamp with time zoneDate and time of item creation.
descriptiontextProvide a user-visible description of the drive.
drive_typetext=Describes the type of drive represented by this resource. OneDrive personal drives will return personal. OneDrive for Business will return business. SharePoint document libraries will return documentLibrary.
etagtextSpecifies the eTag.
filtertext=Odata query to search for resources.
idtext=The unique identifier of the drive.
last_modified_byjsonbIdentity of the user, device, and application which last modified the item.
last_modified_date_timetimestamp with time zoneDate and time the item was last modified.
nametext=The name of the item.
parent_referencejsonbParent information, if the drive has a parent.
sp_connection_nametext=, !=, ~~, ~~*, !~~, !~~*Steampipe connection name.
sp_ctxjsonbSteampipe context in JSON form.
tenant_idtext=, !=, ~~, ~~*, !~~, !~~*The Azure Tenant ID where the resource is located.
titletextTitle of the resource.
user_idtext=ID or email of the user.
web_urltextURL that displays the resource in the browser.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- microsoft365

You can pass the configuration to the command with the --config argument:

steampipe_export_microsoft365 --config '<your_config>' microsoft365_drive