Last year we turned off the ability for users to create sites in Sharepoint Online. We've just discovered a number of sites were created by users last week, and sure enough checking the settings that "Let users create sites" is on again.
I've been asked by my manager to find out if we can see how this happened. Everything I can find about auditing is more about who created sites, edited, changed permissions etc but not about admin settings. Is there a way to find this out, or at least something I can turn on to monitor going forward?