Forum Discussion
Access Level Changed in Teams
Hello community, I'm trying to use the default template "Access Level Change (Teams), that based on the description has the following scope:"This policy is triggered when a team's access level is changed from private to public.
The template is not working. The reason is very clear.
Looking inside the policy it uses the action type "TeamSettingChanged" and the activity objects "private to public"
If I check the activity logs generate with a test user:
and in the raw data:
The point is: Teams does not log any activity like private to public, it logs newvalue/oldvalue
Looking inside the filters anyway I can't see the way to capture that information.
Any idea or suggestion about how to do it ? And which is the reason to publish a template that will never work ?
1 Reply
siastolf Maybe you should consider trying a custom query in Advanced Hunting with a detection rule? Where you check for newValue/public and oldValue/private?
