Forum Discussion
Old ATP portal - activities overview
Hi, I often use the "Activities" overview in the old ATP portal (When I lookup a user) - it gives a quick overview of what a uses actions. But successful and failed - can often be helpful when troub...
LiorShapira
Microsoft
MicrosoftHi Jens,
Yes, you can use Advanced Hunting to see those changes and look for a specific group.
For example:
IdentityDirectoryEvents
| where ActionType =="Group Membership changed"
| extend RemoveFromGroupName=AdditionalFields['FROM.GROUP']
| extend AddToGroupName=AdditionalFields['TO.GROUP']
| where RemoveFromGroupName =="Users" or AddToGroupName =="Users"
In addition, we are working on adding this information to the User timeline (for both users involved in this activity).
Thx alot, will try it soon. Cheers, Jens...