drop microsoft purview onedrive audit export · parse access + share events
flags anonymous links · mass download · permission inheritance · sync client disable · off-hours · actor spikes · bulk destructive
heuristic screener · client/export format varies — column mapping is best-effort · not definitive proof