SOLVED

Filter for all actions on a certain Team

%3CLINGO-SUB%20id%3D%22lingo-sub-1945574%22%20slang%3D%22en-US%22%3EFilter%20for%20all%20actions%20on%20a%20certain%20Team%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1945574%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20everyone%2C%3C%2FP%3E%3CP%3Ei%20am%20confused%20-%20i%20want%20to%20search%20a%20certain%20Team%20for%20user%20actions.%20This%20should%20be%20a%20normal%20task%20to%20complete.%20But%20neither%20the%20guid%20nor%20the%20Team%20name%20nor%20the%20MailNickname%20will%20get%20me%20the%20results.%3C%2FP%3E%3CP%3EWhat%20am%20i%20doing%20wrong%20here%3F%3C%2FP%3E%3CP%3EAll%20docs%2Fvideos%2Fblogs%20i%20find%20-%20filter%20on%20the%20Teams%20actions%20from%20a%20certain%20user.%20Also%20a%20valid%20use%20case%20-%20but%20the%20(i%20think%20normal%20one)%20use%20case%20would%20be%20-%20to%20filter%20on%20a%20Teams.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20anyone%20help%20me%20out%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20in%20advance%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1945574%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EMicrosoft%20365%20Compliance%20Center%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1953731%22%20slang%3D%22en-US%22%3ERe%3A%20Filter%20for%20all%20actions%20on%20a%20certain%20Team%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1953731%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F533323%22%20target%3D%22_blank%22%3E%40StephanGee%3C%2FA%3E%26nbsp%3BHi%2C%20happy%20to%20help.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20tool%20do%20you%20use%2C%20and%20what%20are%20you%20looking%20for%3F%20Can%20you%20provide%20some%20context%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1953918%22%20slang%3D%22en-US%22%3ERe%3A%20Filter%20for%20all%20actions%20on%20a%20certain%20Team%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1953918%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F470541%22%20target%3D%22_blank%22%3E%40JanBakker330%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20example%20my%20boss%20says%3A%20%22In%20our%20team%20was%20a%20channel%20deleted%2Fother%20teams%20setting%20changed%20in%20the%20last%20month%20-%20can%20you%20find%20out%20who%20did%20that%20and%20when%3F%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENormally%20i%20would%20expect%20that%20i%20can%20search%3A%3C%2FP%3E%3CP%3EIn%20this%20Team%3C%2FP%3E%3CP%3ELast%20month%3C%2FP%3E%3CP%3EThis%20action%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20at%20the%20moment%20i%20only%20can%20search%3C%2FP%3E%3CP%3ELast%20month%3C%2FP%3E%3CP%3EThis%20action%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20use%20the%20Audit%20Tool%20from%20the%20M365%20compliance%20center.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1962119%22%20slang%3D%22en-US%22%3ERe%3A%20Filter%20for%20all%20actions%20on%20a%20certain%20Team%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1962119%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F533323%22%20target%3D%22_blank%22%3E%40StephanGee%3C%2FA%3E%26nbsp%3Bah%2C%20I%20see.%20That's%20not%20possible%20with%20the%20Audit%20tool.%20You%20can%20use%20either%20MCAS%20(see%20screenshot)%20for%20that%20or%20%3CA%20href%3D%22https%3A%2F%2Fjeffreyappel.nl%2Fcollect-microsoft-teams-activity-in-azure-sentinel-and-start-hunting%2F%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3ELog%20Analytics%3C%2FA%3E%2C%20using%20KQL.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%221752-07-12-2020.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F238236i8A40C8FFC7045864%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%221752-07-12-2020.png%22%20alt%3D%221752-07-12-2020.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Frequent Contributor

Hi everyone,

i am confused - i want to search a certain Team for user actions. This should be a normal task to complete. But neither the guid nor the Team name nor the MailNickname will get me the results.

What am i doing wrong here?

All docs/videos/blogs i find - filter on the Teams actions from a certain user. Also a valid use case - but the (i think normal one) use case would be - to filter on a Teams. 

 

Can anyone help me out?

 

Thanks in advance

4 Replies

@StephanGee Hi, happy to help.

 

What tool do you use, and what are you looking for? Can you provide some context? 

@JanBakkerOrphaned 

For example my boss says: "In our team was a channel deleted/other teams setting changed in the last month - can you find out who did that and when?"

 

Normally i would expect that i can search:

In this Team

Last month

This action

 

But at the moment i only can search

Last month

This action

 

I use the Audit Tool from the M365 compliance center.

best response confirmed by StephanGee (Frequent Contributor)
Solution

@StephanGee ah, I see. That's not possible with the Audit tool. You can use either MCAS (see screenshot) for that or Log Analytics, using KQL. 

 

1752-07-12-2020.png

Great. Thanks. I will try that