New SharePoint API Usage Reporting Controls in Microsoft Entra: How to Audit and Manage Access Now

Microsoft has introduced significant enhancements to SharePoint API usage reporting in Entra ID, adding new enumeration types, resource relationships, and direct enable/disable controls through the Microsoft Graph beta API. These changes provide visibility and granular management over SharePoint API usage reporting, impacting tenant-level compliance, monitoring, and performance. Here’s what admins need to know.

WHAT’S CHANGING

• apiUsageReportOnboardingStatus: A new enumeration type for onboarding status of API usage reporting.
• sharePoint relationship in adminReportSettings: Connects SharePoint report settings to tenant admin report configuration.
• apiUsageReportEnablementStatus: A new resource type reflecting the enablement state for SharePoint API usage reports.
• sharePointReportSettings resource: Central resource for SharePoint report settings, now with direct methods.
• enableApiUsageReport & disableApiUsageReport methods: API endpoints to toggle SharePoint API usage reporting at the tenant level.

All changes are now available in Microsoft Graph beta endpoints. General Availability is likely to follow, but admins should begin evaluating and testing these controls for production readiness.

WHO’S AFFECTED

• Entra tenants with SharePoint Online enabled
• Global Administrators and SharePoint Administrators
• Any tenant using API-based reporting or monitoring tools for SharePoint
• Tenants with compliance or auditing requirements tied to SharePoint activity
• Organizations leveraging Microsoft Graph for custom SharePoint reporting

WHY IT MATTERS

• Compliance: Ability to enable/disable API usage reporting for SharePoint ensures control over data exposure and audit trails.
• Operational Visibility: New reporting statuses and onboarding state allow for precise tenant-wide monitoring and troubleshooting.
• Licensing & Cost: Monitoring API usage can inform license needs and potential cost optimization.
• Security & Performance: Disabling API usage reporting may reduce data surface but also limits visibility; enabling it increases monitoring but may impact performance.

WHAT TO DO

1. Audit current SharePoint API usage reporting status across your tenant.
2. Review onboarding status for SharePoint API usage reports in adminReportSettings.
3. Test enable/disable actions using Microsoft Graph beta endpoints (dry-run first).
4. Update compliance documentation to reflect new reporting controls and audit logs.
5. Notify stakeholders if disabling API usage reporting will impact monitoring or third-party integrations.

CHECK IT YOURSELF: PowerShell Audit Script

Use the Microsoft.Graph PowerShell module (not deprecated AzureAD/MSOnline) to query SharePoint API usage reporting settings. The script below audits the current enablement status and onboarding state across your tenant. Handles pagination and errors.

# Requires Microsoft.Graph.Beta module
Import-Module Microsoft.Graph.Beta -ErrorAction Stop

# Connect to Graph Beta
Connect-MgGraph -Scopes 'ReportSettings.Read.All', 'Sites.Read.All'

# Query adminReportSettings for SharePoint relationship and onboarding status
try {
    $reportSettings = Get-MgBetaAdminReportSetting -ErrorAction Stop
    if ($reportSettings.sharePoint) {
        $spSettings = $reportSettings.sharePoint
        Write-Host "SharePoint API Usage Reporting Status:" $spSettings.apiUsageReportEnablementStatus
        Write-Host "Onboarding Status:" $spSettings.apiUsageReportOnboardingStatus
    } else {
        Write-Host "No SharePoint report settings found in adminReportSettings."
    }
} catch {
    Write-Warning "Error retrieving SharePoint report settings: $_"
}

# Pagination example for larger tenants (if multiple report settings)
$allReportSettings = @()
$skipToken = $null

while ($true) {
    try {
        $response = Get-MgBetaAdminReportSetting -SkipToken $skipToken -ErrorAction Stop
        $allReportSettings += $response.Value
        $skipToken = $response.OdataNextLink
        if (-not $skipToken) { break }
    } catch {
        Write-Warning "Pagination error: $_"
        break
    }
}

# Output summary
foreach ($setting in $allReportSettings) {
    if ($setting.sharePoint) {
        Write-Host "Tenant: $($setting.id) | SharePoint API Usage Reporting: $($setting.sharePoint.apiUsageReportEnablementStatus) | Onboarding: $($setting.sharePoint.apiUsageReportOnboardingStatus)"
    }
}

Note: This script is purely audit/reporting and does not modify any settings.

PORTAL PATH

1. Go to Microsoft Entra admin center
2. Navigate to Reports > Admin report settings
3. Locate SharePoint report settings section
4. Review API usage report enablement status and onboarding status

If not visible, these settings may still be in beta and accessible via Microsoft Graph API only.

BOTTOM LINE

• Priority: Review SharePoint API usage reporting status in your tenant immediately, especially if you rely on API-driven reporting, compliance, or third-party integrations.
• Test new enable/disable methods in Graph beta; document any changes for audit and compliance.
• Monitor for GA release and update operational scripts and portal workflows accordingly.