Forum Discussion
Old ATP portal - activities overview
Hi Jens,
Yes, you can use Advanced Hunting to see those changes and look for a specific group.
For example:
IdentityDirectoryEvents
| where ActionType =="Group Membership changed"
| extend RemoveFromGroupName=AdditionalFields['FROM.GROUP']
| extend AddToGroupName=AdditionalFields['TO.GROUP']
| where RemoveFromGroupName =="Users" or AddToGroupName =="Users"
In addition, we are working on adding this information to the User timeline (for both users involved in this activity).
this query shows "only" who has been added or removed to/from a group. A bit like described in this article: Track changes to sensitive groups with Advanced Hunting in Microsoft 365 Defender - Microsoft Community Hub
But in the old portal, regarding the timeline of an on-premises Active Directory Group, I also could see who has added/removed the user, even when the group wasn't marked as sensitive.
Here a screenshot from "older days".
Cheers, Jens...
- LiorShapiraMar 01, 2023MicrosoftAs I mentioned above, we are working on adding the same information to the new User timeline, and also adding the ability to filter and look for a specific activity such as "group membership changed" (for both sensitive/non-sensitive groups, in Advanced hunting is already for both).
- AraDillMar 22, 2023Copper Contributor
LiorShapira So MSFT forced everyone to use the "new" portal before they had full functionality? Great user experience...
- LiorShapiraMar 23, 2023Microsoft
AraDill The defender for identity experience is converged into the Microsoft 365 Defender portal, with that, we feel that the information contained in the classic portal experience can now be presented in a more unified manner, aligned with the additional defender workload, such as unified alert and incident queue, advanced hunting and Secure Score recommendations.
Please take a few minutes to share with us which functionality you feel is missing: https://aka.ms/MdiRedirectionSurvey