Forum Discussion
Audit Log - User shown as App@sharepoint
When I do a search of an audit log in the S&C Center for the Created Site Collection activity, many of the results show a User of app@sharepoint, many other results show real user accounts.
Does anyone know what would cause this activity to be performed by the app@sharepoint account?
3 Replies
I ran some more tests and determined that when a user creates an a group from Yammer, Outlook or Teams, then the Unified log shows the creation of the Site Collection as being created by app@sharepoint.com because this service account is run on behalf of the actual creator.
Hi Dean, i'm replying to an old thread of yours.
I was wondering. How did you found out who were the actual users when you saw mailto:app@sharepoint in your audit log? I see the same, but i can't find a way to link it to an actual user.
- Sorry, I'm not sure, but it was probably by looking at the time of the event
