Aug 14 2017 02:41 PM
Good afternoon,
We have a planner group that appears to have been deleted. Thankfully I do see a restore group process available to hopefully restore any deleted content.
Is there anyway to see the details of what user deleted the group?
I was able to find the deleted group with the Get-AzureADMSDeletedGroup comand in ADM for for Win Powershell.
Thanks
Aug 15 2017 04:02 AM
Aug 15 2017 05:18 AM
Thank you for the information.
If it is something that needs to be enabled manually my guess is it hasn't been.
Do you know where I can find documentation on that process?
Thanks
Aug 15 2017 05:27 AM
@Kyle DePalma wrote:Do you know where I can find documentation on that process?
Just to chip in, it is outlined here - Search the audit log in the Office 365 Security & Compliance Center with details on how to get started on the 'Before you begin' tab, including:
" You (or another admin) must first turn on audit logging before you can start searching the Office 365 audit log. To turn it on, just click Start recording user and admin activity on the Audit log search page in the Security & Compliance Center. (If you don't see this link, auditing has already been turned on for your organization.) After you turn it on, a message is displayed that says the audit log is being prepared and that you can run a search in a couple of hours after the preparation is complete. You only have to do this once."
Check the link for more details.