Audit Log - User shown as App@sharepoint

[Dean Gross]

When I do a search of an audit log in the S&C Center for the Created Site Collection activity, many of the results show a User of app@sharepoint, many other results show real user accounts.

Does anyone know what would cause this activity to be performed by the app@sharepoint account?

[#2]

I ran some more tests and determined that when a user creates an a group from Yammer, Outlook or Teams, then the Unified log shows the creation of the Site Collection as being created by app@sharepoint.com  because this service account is run on behalf of the actual creator.

[#3]

@Dean Gross 

Hi Dean, i'm replying to an old thread of yours.

I was wondering. How did you found out who were the actual users when you saw app@sharepoint in your audit log? I see the same, but i can't find a way to link it to an actual user.

[#4]

Sorry, I'm not sure, but it was probably by looking at the time of the event