Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
SOLVED

Filter for all actions on a certain Team

Steel Contributor

Hi everyone,

i am confused - i want to search a certain Team for user actions. This should be a normal task to complete. But neither the guid nor the Team name nor the MailNickname will get me the results.

What am i doing wrong here?

All docs/videos/blogs i find - filter on the Teams actions from a certain user. Also a valid use case - but the (i think normal one) use case would be - to filter on a Teams. 

 

Can anyone help me out?

 

Thanks in advance

4 Replies

@StephanGee Hi, happy to help.

 

What tool do you use, and what are you looking for? Can you provide some context? 

@JanBakkerOrphaned 

For example my boss says: "In our team was a channel deleted/other teams setting changed in the last month - can you find out who did that and when?"

 

Normally i would expect that i can search:

In this Team

Last month

This action

 

But at the moment i only can search

Last month

This action

 

I use the Audit Tool from the M365 compliance center.

best response confirmed by StephanGee (Steel Contributor)
Solution

@StephanGee ah, I see. That's not possible with the Audit tool. You can use either MCAS (see screenshot) for that or Log Analytics, using KQL. 

 

1752-07-12-2020.png

Great. Thanks. I will try that
1 best response

Accepted Solutions
best response confirmed by StephanGee (Steel Contributor)
Solution

@StephanGee ah, I see. That's not possible with the Audit tool. You can use either MCAS (see screenshot) for that or Log Analytics, using KQL. 

 

1752-07-12-2020.png

View solution in original post