Audit Log - User shown as App@sharepoint

%3CLINGO-SUB%20id%3D%22lingo-sub-175657%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20-%20User%20shown%20as%20App%40sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-175657%22%20slang%3D%22en-US%22%3E%3CP%3EI%20ran%20some%20more%20tests%20and%20determined%20that%20when%20a%20user%20creates%20an%20a%20group%20from%20Yammer%2C%20Outlook%20or%20Teams%2C%20then%20the%20Unified%20log%20shows%20the%20creation%20of%20the%20Site%20Collection%20as%20being%20created%20by%20%3CA%20href%3D%22mailto%3Aapp%40sharepoint.com%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Eapp%40sharepoint.com%3C%2FA%3E%26nbsp%3B%20because%20this%20service%20account%20is%20run%20on%20behalf%20of%20the%20actual%20creator.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-171568%22%20slang%3D%22en-US%22%3EAudit%20Log%20-%20User%20shown%20as%20App%40sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-171568%22%20slang%3D%22en-US%22%3E%3CP%3EWhen%20I%20do%20a%20search%20of%20an%20audit%20log%20in%20the%20S%26amp%3BC%20Center%20for%20the%20Created%20Site%20Collection%20activity%2C%20many%20of%20the%20results%20show%20a%20User%20of%20app%40sharepoint%2C%20many%20other%20results%20show%20real%20user%20accounts.%3C%2FP%3E%0A%3CP%3EDoes%20anyone%20know%20what%20would%20cause%20this%20activity%20to%20be%20performed%20by%20the%20app%40sharepoint%20account%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-171568%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECompliance%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Respected Contributor

When I do a search of an audit log in the S&C Center for the Created Site Collection activity, many of the results show a User of app@sharepoint, many other results show real user accounts.

Does anyone know what would cause this activity to be performed by the app@sharepoint account?

1 Reply

I ran some more tests and determined that when a user creates an a group from Yammer, Outlook or Teams, then the Unified log shows the creation of the Site Collection as being created by app@sharepoint.com  because this service account is run on behalf of the actual creator.