Microsoft 365 Admin visibility for Guest Users Activity

Question

Is there a way for Admin to have granular visibility for guest users in M365 tenant?

- who added the guest user

- what data can the guest access

- when the guest was added

- which group the guest is a member of

- mail notifications to admin that a guest was added

- Audit logs of all guest activity

thanks

christianbergstrom · Answer

Marvin Oco&nbsp;Hey, as far as I know you'll need to use the SCC to search the unified audit log.&nbsp;https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide

thijs lecomte · Answer

There are like 7/8 different ways to invite a guest and depending on the used method, the logs will be in a different place.

You should look into AAD logs and the Unified Audit Log.

For notifications I would look into MCAS or Sentinel.

The group membership of a guest should be done through a custom script

Forum Discussion

Microsoft 365 Admin visibility for Guest Users Activity

Share

Resources