Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

Audit Log - User shown as App@sharepoint

Silver Contributor

When I do a search of an audit log in the S&C Center for the Created Site Collection activity, many of the results show a User of app@sharepoint, many other results show real user accounts.

Does anyone know what would cause this activity to be performed by the app@sharepoint account?

3 Replies

I ran some more tests and determined that when a user creates an a group from Yammer, Outlook or Teams, then the Unified log shows the creation of the Site Collection as being created by app@sharepoint.com  because this service account is run on behalf of the actual creator.

@Dean Gross 

 

Hi Dean, i'm replying to an old thread of yours.

 

I was wondering. How did you found out who were the actual users when you saw app@sharepoint in your audit log? I see the same, but i can't find a way to link it to an actual user.

Sorry, I'm not sure, but it was probably by looking at the time of the event