I noticed that the following are missing from the schema in OfficeActivity logs:
TargetUserOrGroupType: Identifies whether the target user or group is a Member, Guest, SharePointGroup, SecurityGroup, or Partner.
TargetUserOrGroupName: Stores the UPN or name of the target user or group that a resource was shared with (User B in the previous example).
This is key information to determine whether information was shared with a Guest identity or a Member identity.
The only thing I found regarding this issue was a feedback post from September: https://feedback.azure.com/forums/920458-azure-sentinel/suggestions/38501344-add-targetuser-and-targ...
Is this going to be added in the near future? Or is there a possible work around to get this information into a query?
Th
