We're looking to audit creation of Teams administrative functions in Azure and I've seen references to this info being available in Cloud App Security activity logs.
Specifically I'm looking to audit deletion and creation events for PSTNGateways/SBC objects. We ran a test create and delete in our tenant and I can see the option in the MCAS activity log for activity type equals New-CSOnlinePSTNGateway but this is not returning any results.
Is this just an ingestion delay or do I need to enable an auditing setting somewhere else to be able to view/alert on this type of activity?
Thanks
Danny
