Box vs SharePoint sharing reports: find the access a CSV misses

To reconcile sharing access, count distinct files and people separately from report rows, then check the routes the reports leave unresolved. A SharePoint CSV can show a group without its members and omit an Anyone link. A Box shared links report can show a raw status of Open even when its derived status is more restrictive. Neither row count alone answers who can reach a file.

Get the reports that answer different questions

A SharePoint site administrator can go to Settings → Site usage → Shared with external users → Run report, choose a private folder for the report, and receive an email when it is ready. The CSV describes unique combinations of file, user, permission, and link. It includes fields for the resource path, user or group, link ID, link type, and AccessViaLinkID. Microsoft’s sharing reports documentation explains the report and its coverage.

For Box, Folder Insights gives a folder owner reports about internal and external collaborators, shared links, and activity. Export the collaborator and shared link inventories when the question includes both named access and link access. Box allows up to 10 exports of each report type per user per day; exports go to Box Reports by default, with an option to choose another folder. Box’s Folder Insights guide describes those reports.

Keep the exports separate while counting. A collaborator entry and a shared link entry describe different access routes, and a person may appear in more than one SharePoint row.

Read SharePoint rows at the right grain

Use this synthetic SharePoint CSV to practice. Its six data rows cover four distinct Resource Path values. Two rows have User or Group Type set to Guest, but both contain reviewer@example.net in User E-mail. That is two guest rows and one distinct guest email, not evidence of two distinct external recipients. It also does not establish the complete external population of the site.

The invented brief.docx has a named guest row with Read permission. The invented contract.pdf has a Specific People link row whose Link ID is 11111111-1111-4111-8111-111111111111. A guest row for the same file carries that value in AccessViaLinkID. Match those IDs before counting routes: the rows describe the link and a guest’s access through it, not two independent links.

The archive.pdf row names a SharePoint group, Old Project Visitors. The CSV does not list that group’s individual members. Record its membership as unresolved until you check the group itself; the group name is not a count of people. Microsoft also says the report does not include Anyone links or directly emailed links that recipients have not clicked. A zero count for those routes in this CSV therefore cannot establish that none exist. Microsoft documents these report limits.

Reproduce the counts

In Excel, turn on filters for the sample’s actual column names. Filter User or Group Type to Guest to see the two guest rows. For a distinct-person count, copy the nonblank User E-mail values from those rows to a separate sheet and use Data → Remove Duplicates on the copy. Do the same with Resource Path to count four files without discarding permission rows from the original sheet. Filter Link ID and AccessViaLinkID to find the matching contract route.

PowerShell’s built-in CSV commands produce the same counts after you download the files into the current folder:

$sp = Import-Csv .\sharepoint-sharing-example.csv
$box = Import-Csv .\box-shared-links-example.csv

($sp | Measure-Object).Count
($sp | Group-Object -Property 'Resource Path' | Measure-Object).Count
($sp | Where-Object { $_.'User or Group Type' -eq 'Guest' } | Measure-Object).Count
($sp | Where-Object { $_.'User or Group Type' -eq 'Guest' -and $_.'User E-mail' } |
    Group-Object -Property 'User E-mail' | Measure-Object).Count

$box | Group-Object -Property 'Shared Link Status' | Select-Object Name, Count
$box | Group-Object -Property 'Shared Link Derived Status' | Select-Object Name, Count

The first four results are 6, 4, 2, and 1. Grouping the Box rows by both status columns exposes another counting trap.

Check Box’s derived status

The synthetic Box shared links CSV has three items. Its Shared Link Status values are Open for two items and Collaborators for one. Its Shared Link Derived Status values are Open for one, Company for one, and Collaborators for one. Thus, counting raw Open rows gives two, while counting rows whose derived status is Open gives one.

Box’s shared links report includes item ID and name, shared item type, status, derived status, URL, creation date, and permissions. Box says derived status reflects restrictions on a link. It also explains that Permissions set to None for a Collaborators link can reflect permission inherited through collaboration; it does not mean nobody has access. An optional access-level filter includes only the levels selected, so check that filter before treating an export as the full inventory. Box’s shared links report guide defines these fields.

The sample URLs use example.com as placeholders. They are practice data, not Box links to investigate.

Reconcile what the exports cannot settle

The synthetic observations CSV demonstrates how to keep follow-up findings beside the SharePoint calculation. Its budget.xlsx entry says illustrative current settings reveal an Anyone link absent from the report. That is one illustrated missing route, not a finding about a real tenant. Its archive.pdf entry marks one group whose membership needs checking.

For this practice case, a useful reconciliation reads: six SharePoint rows; four distinct resource paths; two guest rows representing one distinct guest email; one illustrated Anyone route missing from the CSV; and one group to expand. The Box sample separately contains three shared-link items, with one Open derived status.

For the example, an owner could write three follow-up entries:

Sample item	What the CSV establishes	What the owner still needs
budget.xlsx	The visible row names an internal member.	Inspect the item for the illustrated Anyone route; decide whether it is authorized.
archive.pdf	Old Project Visitors is a group with Read access.	Obtain current membership and identify which recipients still need this archive.
contract.pdf	The link and guest route share one ID.	Confirm whether review is complete before proposing removal of that route.

This is a proposed action log, not a statement that the changes occurred. For Box item 1001, the sample’s derived Open value warrants an owner decision about that particular review link. Item 1002’s raw Open value alone should not be counted as a second effectively Open link: its derived value is Company. Keep the CSV export time, the time of a later settings check and the approved change time in separate columns. A later change cannot rewrite what the earlier export showed.

For your own files, confirm group membership and inspect the relevant item’s current sharing settings before deciding whether access should change. Obtain the owner’s approval for a proposed change, make it in the actual settings, then inspect the settings and a fresh export to verify the result. The synthetic observation proposing removal of the contract link or budget link does not show that either removal happened.

Vendor documentation was checked October 7, 2026. The linked CSVs are authored examples and were parsed locally. No live tenant or sharing change was tested.