Guest user activity

%3CLINGO-SUB%20id%3D%22lingo-sub-299226%22%20slang%3D%22en-US%22%3EGuest%20user%20activity%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-299226%22%20slang%3D%22en-US%22%3E%3CP%3EWondering%20if%20anyone%20has%20found%20a%20way%20to%20check%20on%20activity%20for%20guest%20users.%3CBR%20%2F%3E%3CBR%20%2F%3EFor%20instance%2C%20last%20time%20they%20even%20logged%20in%20or%20last%20password%20reset%20like%20the%20things%20you're%20able%20to%20find%20in%20MSOL.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ETrying%20to%20scope%20out%20the%20inactive%20guest%20users.%3CBR%20%2F%3E%3CBR%20%2F%3EThe%20closest%20thing%20I%20can%20find%20is%20the%20WhenChanged%20attribute%20within%20their%20mailuser%20and%20even%20that%20value%20is%20a%20bit%20unreliable.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-299226%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EActivity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EGuest%20User%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-482750%22%20slang%3D%22en-US%22%3ERe%3A%20Guest%20user%20activity%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-482750%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F150564%22%20target%3D%22_blank%22%3E%40Justin%20Scarborough%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAh%20gotcha%2C%20sorry%20not%20sure%20for%20tenant%20wide.%3CBR%20%2F%3E%3CBR%20%2F%3EI%20meant%20for%20a%20specific%20guest%20user.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-482745%22%20slang%3D%22en-US%22%3ERe%3A%20Guest%20user%20activity%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-482745%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F102467%22%20target%3D%22_blank%22%3E%40Anthony%20Leong%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20assuming%20the%20AL%20located%20in%20Azure.%20I%20was%20in%20there%20-%20and%20I%20am%20somewhat%20barely%20familiar%20with%20how%20to%20pull%20it.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAre%20you%20able%20to%20tell%20me%20certain%20conditions%20i%20can%20use%20to%20pull%20it%20faster%3F%20If%20i%20do%20the%20initiated%20by%20actor%20-%20my%20name%20-%20it%20pulls%20up%20everything%20I%20do%20when%20I%20am%20just%20trying%20to%20look%20for%20a%20specific%20%22Who%20turned%20on%20guest%20access%22%20not%20per%20account%20-%20But%20tenant%20wide%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-482739%22%20slang%3D%22en-US%22%3ERe%3A%20Guest%20user%20activity%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-482739%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F150564%22%20target%3D%22_blank%22%3E%40Justin%20Scarborough%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20should%20be%20in%20the%20Audit%20logs%20for%20the%20guest%20user.%3CBR%20%2F%3E%3CBR%20%2F%3EUnder%20the%20Initiated%20by%20(Actor)%20field.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-482737%22%20slang%3D%22en-US%22%3ERe%3A%20Guest%20user%20activity%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-482737%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWould%20you%20happen%20to%20know%20how%20to%20search%20who%20enabled%20%22guests%22%20access%20in%20Teams%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-299458%22%20slang%3D%22en-US%22%3ERe%3A%20Guest%20user%20activity%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-299458%22%20slang%3D%22en-US%22%3E%3CP%3EGuest%20activities%20should%20be%20recorded%20in%20the%20Office%20365%20Unified%20Audit%20log%2C%20just%20like%20with%20regular%20users.%20On%20the%20Azure%20AD%20side%20of%20things%2C%20you%20can%20check%20the%20Sign-in%20logs%2C%20which%20you%20already%20found%2C%20and%20the%20Audit%20logs%20next%20to%20them.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-299233%22%20slang%3D%22en-US%22%3ERe%3A%20Guest%20user%20activity%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-299233%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Adam!%3CBR%20%2F%3E%3CBR%20%2F%3EThanks%2C%20yeah%20I%20believe%20I've%20seen%20that%20article%20before%20and%20it%20deals%20more%20with%20Guest%20users%20within%20certain%20teams.%3CBR%20%2F%3E%3CBR%20%2F%3EMy%20ultimate%20goal%20was%20to%20reduce%20the%20number%20of%20Guest%20users%20in%20my%20tenant%2C%20as%20it%20appears%20to%20be%20getting%20out%20of%20hand.%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EWith%20this%2C%20I%20was%20hoping%20to%20see%20if%20the%20Guest%20user%20hasn't%20logged%20in%20within%20a%20few%20months%20or%20a%20year%20we%20can%20simply%20delete%20them.%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EI%20did%20find%20this%20sign%20in%20log%26nbsp%3Btutorial%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Freports-monitoring%2Ftutorial-signin-logs-download-script%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Freports-monitoring%2Ftutorial-signin-logs-download-script%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3CBR%20%2F%3EBut%20i%20believe%20its%20only%20checks%20up%20to%20a%20month%20if%20I%20recall%20correctly.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-299229%22%20slang%3D%22en-US%22%3ERe%3A%20Guest%20user%20activity%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-299229%22%20slang%3D%22en-US%22%3ETake%20a%20look%20at%20access%20review%3A%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen%2Fazure%2Factive-directory%2Fgovernance%2Fmanage-guest-access-with-access-reviews%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen%2Fazure%2Factive-directory%2Fgovernance%2Fmanage-guest-access-with-access-reviews%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-842045%22%20slang%3D%22en-US%22%3ERe%3A%20Guest%20user%20activity%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-842045%22%20slang%3D%22en-US%22%3ELook%20Adam%2C%20I%20need%20the%20same%20login%20information%20for%20guest%20users%2C%20did%20you%20get%20anything%3F%3C%2FLINGO-BODY%3E
Anthony Leong
Occasional Contributor

Wondering if anyone has found a way to check on activity for guest users.

For instance, last time they even logged in or last password reset like the things you're able to find in MSOL. 

 

Trying to scope out the inactive guest users.

The closest thing I can find is the WhenChanged attribute within their mailuser and even that value is a bit unreliable. 

8 Replies

Hi Adam!

Thanks, yeah I believe I've seen that article before and it deals more with Guest users within certain teams.

My ultimate goal was to reduce the number of Guest users in my tenant, as it appears to be getting out of hand. 

With this, I was hoping to see if the Guest user hasn't logged in within a few months or a year we can simply delete them. 

I did find this sign in log tutorial: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/tutorial-signin-logs-down...

 
But i believe its only checks up to a month if I recall correctly. 

Guest activities should be recorded in the Office 365 Unified Audit log, just like with regular users. On the Azure AD side of things, you can check the Sign-in logs, which you already found, and the Audit logs next to them.

@Vasil Michev 

 

Would you happen to know how to search who enabled "guests" access in Teams?

@Justin Scarborough 

 

It should be in the Audit logs for the guest user.

Under the Initiated by (Actor) field.

@Anthony Leong 

 

I am assuming the AL located in Azure. I was in there - and I am somewhat barely familiar with how to pull it. 

 

Are you able to tell me certain conditions i can use to pull it faster? If i do the initiated by actor - my name - it pulls up everything I do when I am just trying to look for a specific "Who turned on guest access" not per account - But tenant wide

@Justin Scarborough

 

 

Ah gotcha, sorry not sure for tenant wide.

I meant for a specific guest user. 

Look Adam, I need the same login information for guest users, did you get anything?
Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
36 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
9 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies