SOLVED

Office 365 Audit Log Search

%3CLINGO-SUB%20id%3D%22lingo-sub-84440%22%20slang%3D%22en-US%22%3EOffice%20365%20Audit%20Log%20Search%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-84440%22%20slang%3D%22en-US%22%3E%3CP%3E%3CFONT%20color%3D%22%23000000%22%20face%3D%22Calibri%22%3EUsing%20Office%20365%20Security%20%26amp%3B%20Compliance%20%26gt%3B%20Audit%20log%20search%2C%20do%20you%20know%20if%20it%E2%80%99s%20possible%20to%20report%20on%20when%20a%20user%20was%20added%20to%20a%20specific%20group%3F%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%3CFONT%20color%3D%22%23000000%22%20face%3D%22Calibri%22%3Ei.e.%20when%20a%20user%20was%20added%20to%20a%20SharePoint%20Online%20site%20members%20group%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-84440%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-97551%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Audit%20Log%20Search%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-97551%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20using%20%3CA%20href%3D%22http%3A%2F%2Fwww.screentogif.com%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3EScreenToGif%3C%2FA%3E%26nbsp%3Btool%20to%20capture%20the%20desktop%20activity%20as%20a%20GIF.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-97544%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Audit%20Log%20Search%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-97544%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20a%20cool%20way%20to%20show%20a%20tutorial.%20Would%20you%20mind%20sharing%20how%20you%20created%20it%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-84555%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Audit%20Log%20Search%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-84555%22%20slang%3D%22en-US%22%3E%3CP%3EYes%2C%20it's%20possible%2C%20%26nbsp%3BAs%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%20said%20you%20need%20to%20narrow%20down%20your%20search%20to%20just%20'AddedToGroup'%20in%20the%20'Site%20Administration%20Activities'.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20731px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F16771i5B12290F7FD4062C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22sp_log_search_add_to_group.gif%22%20title%3D%22sp_log_search_add_to_group.gif%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3ESharePoint%20Group%20Member%20Addition%20Activity%20Search%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EIn%20case%20you%20are%20looking%20for%20a%20direct%20report%20which%20offers%26nbsp%3Bscheduling%20and%20more%20filtering%20capabilities%20to%20check%20'when%20a%20user%20was%20added%20to%20a%20SharePoint%20Online%20site%20members%20group'%20then%20you%20can%20try%20AdminDroid%20Reports.%20Check%20out%20the%20online%20demo%20%3CA%20title%3D%22AdminDroid%20Office%20365%20Reporter%20Online%20Demo%22%20href%3D%22http%3A%2F%2Fdemo.admindroid.com%2F%23%2Faudit%2Fsharepoint%2Freports%2F22014%2F1%2F20%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-84468%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Audit%20Log%20Search%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-84468%22%20slang%3D%22en-US%22%3E%3CP%3EIt%20should%20be%20audited%20via%20the%20AddedToGroup%26nbsp%3Bevent%20in%20the%20Site%20administration%20activities%20section%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%20class%3D%22lia-spoiler-container%22%3E%3CA%20class%3D%22lia-spoiler-link%22%20href%3D%22%23%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3ESpoiler%3C%2FA%3E%3CNOSCRIPT%3E(Highlight%20to%20read)%3C%2FNOSCRIPT%3E%3CDIV%20class%3D%22lia-spoiler-border%22%3E%3CDIV%20class%3D%22lia-spoiler-content%22%3EAdded%20user%20or%20group%20to%20SharePoint%20group%26nbsp%3B%3CBR%20%2F%3EAddedToGroup%26nbsp%3B%3CBR%20%2F%3EUser%20added%20a%20member%20or%20guest%20to%20a%20SharePoint%20group.%20This%20might%20have%20been%20an%20intentional%20action%20or%20the%20result%20of%20another%20activity%2C%20such%20as%20a%20sharing%20event.%3C%2FDIV%3E%3CNOSCRIPT%3E%3CDIV%20class%3D%22lia-spoiler-noscript-container%22%3E%3CDIV%20class%3D%22lia-spoiler-noscript-content%22%3EAdded%20user%20or%20group%20to%20SharePoint%20group%26nbsp%3BAddedToGroup%26nbsp%3BUser%20added%20a%20member%20or%20guest%20to%20a%20SharePoint%20group.%20This%20might%20have%20been%20an%20intentional%20action%20or%20the%20result%20of%20another%20activity%2C%20such%20as%20a%20sharing%20event.%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FNOSCRIPT%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CP%3EAs%20per%3A%20%3CA%20href%3D%22https%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2FSearch-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c%23siteadminactivities%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2FSearch-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c%23siteadminactivities%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Using Office 365 Security & Compliance > Audit log search, do you know if it’s possible to report on when a user was added to a specific group?

i.e. when a user was added to a SharePoint Online site members group

 

4 Replies

It should be audited via the AddedToGroup event in the Site administration activities section

 

Spoiler
Added user or group to SharePoint group 
AddedToGroup 
User added a member or guest to a SharePoint group. This might have been an intentional action or the result of another activity, such as a sharing event.

As per: https://support.office.com/en-us/article/Search-the-audit-log-in-the-Office-365-Security-Compliance-...

 

Best Response confirmed by Robert Luck (Frequent Contributor)
Solution

Yes, it's possible,  As @Vasil Michev said you need to narrow down your search to just 'AddedToGroup' in the 'Site Administration Activities'.

 

SharePoint Group Member Addition Activity SearchSharePoint Group Member Addition Activity Search

 

In case you are looking for a direct report which offers scheduling and more filtering capabilities to check 'when a user was added to a SharePoint Online site members group' then you can try AdminDroid Reports. Check out the online demo here.

This is a cool way to show a tutorial. Would you mind sharing how you created it?

I am using ScreenToGif tool to capture the desktop activity as a GIF.