Alert for Team rename

[Thomsch]

I'm unfortunately not able to setup an ALERT for the scenario when a user renames a Team.

Is that possible and what's the best way to do that?

[#2]

What's the end goal here? You can use the alert policies functionality: https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide

[#3]

Actually I'm not able to find an alert there for Teams activities?!

The goal is to provide a naming policy, which is as following:

Prefix = extensionAttribute15

Suffix = extensionAttribute14

And as soon as a Teams is renamed, I'll have to manually establish that naming policy since as far as I know it's not possible to create such a policy via the Azure portal or via powershell.

[#4]

There is a built-in naming policy functionality: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-naming-policy

[#5]

@Vasil Michev and how would you use that one for my requirements?

[#6]

Isn't "establish a name policy" exactly what you are trying to achieve here?

[#7]

It is. But I'm not able to create a name policy which uses the extensionAttribute15 from a specific user. Or at least I have no idea how to do so. I would be amazed if that's possible.

[#8]

@Vasil Michev  any ideas?

[#9 · Accepted solution]

You're right, you cannot use said attribute in a naming policy. So we're back to the initial suggestion to use an alert policy or crawl the unified audit log for any "team rename" events, then execute any necessary actions. 

[#10]

@Vasil Michev I was a able to create such an Office 365 activity alert and I also get the notification mails. But unfortunately I'm not able to find and edit it. The alert is not listed within the Security & Compliance section: https://protection.office.com/viewalerts or https://protection.office.com/alertpolicies

I created the alert at New alert Policy (https://protection.office.com/unifiedauditlog).

Thanks in advance

[#11]

Did you check under good old Activity alerts: https://protection.office.com/managealerts

You can also try Get-ActivityAlert/Get-ProtectionAlert

[#12]

Awesome! How can I get there via the menue?

[#13]

SCC -> Alerts -> Dashboard -> at the bottom, click Activity alerts within the Other alerts box.