Forum Discussion
Find who changed settings
Last year we turned off the ability for users to create sites in Sharepoint Online. We've just discovered a number of sites were created by users last week, and sure enough checking the settings that "Let users create sites" is on again.
I've been asked by my manager to find out if we can see how this happened. Everything I can find about auditing is more about who created sites, edited, changed permissions etc but not about admin settings. Is there a way to find this out, or at least something I can turn on to monitor going forward?
Jase
Generally speaking, your best bet is to query the Office 365 Unified Audit log: https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance
However, as far as I'm aware changes for this particular setting are not being audited...
1 Reply
Generally speaking, your best bet is to query the Office 365 Unified Audit log: https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance
However, as far as I'm aware changes for this particular setting are not being audited...