Audit Log - User shown as App@sharepoint

%3CLINGO-SUB%20id%3D%22lingo-sub-175657%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20-%20User%20shown%20as%20App%40sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-175657%22%20slang%3D%22en-US%22%3E%3CP%3EI%20ran%20some%20more%20tests%20and%20determined%20that%20when%20a%20user%20creates%20an%20a%20group%20from%20Yammer%2C%20Outlook%20or%20Teams%2C%20then%20the%20Unified%20log%20shows%20the%20creation%20of%20the%20Site%20Collection%20as%20being%20created%20by%20%3CA%20href%3D%22mailto%3Aapp%40sharepoint.com%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Eapp%40sharepoint.com%3C%2FA%3E%26nbsp%3B%20because%20this%20service%20account%20is%20run%20on%20behalf%20of%20the%20actual%20creator.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-171568%22%20slang%3D%22en-US%22%3EAudit%20Log%20-%20User%20shown%20as%20App%40sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-171568%22%20slang%3D%22en-US%22%3E%3CP%3EWhen%20I%20do%20a%20search%20of%20an%20audit%20log%20in%20the%20S%26amp%3BC%20Center%20for%20the%20Created%20Site%20Collection%20activity%2C%20many%20of%20the%20results%20show%20a%20User%20of%20app%40sharepoint%2C%20many%20other%20results%20show%20real%20user%20accounts.%3C%2FP%3E%0A%3CP%3EDoes%20anyone%20know%20what%20would%20cause%20this%20activity%20to%20be%20performed%20by%20the%20app%40sharepoint%20account%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-171568%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECompliance%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2471628%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20-%20User%20shown%20as%20App%40sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2471628%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1096%22%20target%3D%22_blank%22%3E%40Dean%20Gross%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%20Dean%2C%20i'm%20replying%20to%20an%20old%20thread%20of%20yours.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20was%20wondering.%20How%20did%20you%20found%20out%20who%20were%20the%20actual%20users%20when%20you%20saw%20%3CA%20href%3D%22mailto%3Aapp%40sharepoint%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Eapp%40sharepoint%3C%2FA%3E%26nbsp%3Bin%20your%20audit%20log%3F%20I%20see%20the%20same%2C%20but%20i%20can't%20find%20a%20way%20to%20link%20it%20to%20an%20actual%20user.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2475443%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20-%20User%20shown%20as%20App%40sharepoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2475443%22%20slang%3D%22en-US%22%3ESorry%2C%20I'm%20not%20sure%2C%20but%20it%20was%20probably%20by%20looking%20at%20the%20time%20of%20the%20event%3C%2FLINGO-BODY%3E
Respected Contributor

When I do a search of an audit log in the S&C Center for the Created Site Collection activity, many of the results show a User of app@sharepoint, many other results show real user accounts.

Does anyone know what would cause this activity to be performed by the app@sharepoint account?

3 Replies

I ran some more tests and determined that when a user creates an a group from Yammer, Outlook or Teams, then the Unified log shows the creation of the Site Collection as being created by app@sharepoint.com  because this service account is run on behalf of the actual creator.

@Dean Gross 

 

Hi Dean, i'm replying to an old thread of yours.

 

I was wondering. How did you found out who were the actual users when you saw app@sharepoint in your audit log? I see the same, but i can't find a way to link it to an actual user.

Sorry, I'm not sure, but it was probably by looking at the time of the event