Forum Discussion

leoszalkowski's avatar
leoszalkowski
Brass Contributor
Dec 04, 2019

TargetUserOrGroupType and TargetUserOrGroupName missing in OfficeActivity Schema

I noticed that the following are missing from the schema in OfficeActivity logs:

  • TargetUserOrGroupType: Identifies whether the target user or group is a Member, Guest, SharePointGroup, SecurityGroup, or Partner.

  • TargetUserOrGroupName: Stores the UPN or name of the target user or group that a resource was shared with (User B in the previous example).

This is key information to determine whether information was shared with a Guest identity or a Member identity. 

 

The only thing I found regarding this issue was a feedback post from September: https://feedback.azure.com/forums/920458-azure-sentinel/suggestions/38501344-add-targetuser-and-targetgroup-from-the-sharepoint

 

Is this going to be added in the near future? Or is there a possible work around to get this information into a query?

 

Th