Oct 17 2019 06:41 AM
Office 365 applications now create many guest accounts in Azure Active Directory. You can see what accounts exist, but it's more difficult to discover who created the accounts - or why they were created. Fortunately, the Office 365 audit log holds a lot of useful data that can be interrogated to find some answers and PowerShell is a great tool for slicing and dicing audit data. See what you think of the answers I've come up with.