Forum Discussion

Iron Contributor

Feb 08, 2019

Solved

Onedrive audit log when admin logs into user account - what's expected behaviour?

Hi what should I see in the audit log when an admin grants themselves access to a users onedrive account? If I go to the security and compliance centre and use the investigation tab to look a...

admin

audit

OneDrive for Business

DazzaR
Feb 18, 2019
Just correcting this as in light of new information. After another look at this, I can in fact see the name of the admin granting themselves access. I don't know how I missed this the first time around, nor how my colleague did who also tested it for me. Did we both miss it, or did MS change something? Who knows.
In the audit log under more information there's a clear and obvious box that shows the admin name. Whilst setting alerts on this is clunky because it comes through as app@sharepoint, at least you can manually investigate and get a name.

DazzaR

Iron Contributor

Feb 11, 2019

So I got a reply. MS tell me this is expected behaviour. App@sharepoint will appear in the logs unless the admin actions a change in a file, then the audit will show the admin's details. So, if like us, your org has around 20 admin, you could go snooping, sort-off. I don't think that's ideal.

DazzaR

Iron Contributor

Feb 18, 2019

Just correcting this as in light of new information. After another look at this, I can in fact see the name of the admin granting themselves access. I don't know how I missed this the first time around, nor how my colleague did who also tested it for me. Did we both miss it, or did MS change something? Who knows.

In the audit log under more information there's a clear and obvious box that shows the admin name. Whilst setting alerts on this is clunky because it comes through as app@sharepoint, at least you can manually investigate and get a name.