SOLVED

O365 Audit Log Search User Added to Group

%3CLINGO-SUB%20id%3D%22lingo-sub-286209%22%20slang%3D%22en-US%22%3EO365%20Audit%20Log%20Search%20User%20Added%20to%20Group%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-286209%22%20slang%3D%22en-US%22%3E%3CP%3EI've%20run%20a%20search%20using%20the%20%3CSTRONG%3EAdded%20member%20to%20group%3C%2FSTRONG%3E%20under%20the%20%3CSTRONG%3EAzure%20AD%20group%20administration%20activities%3C%2FSTRONG%3E%20section%20and%20that%20does%20provide%20some%20useful%20output%20like%3B%20who%20the%20user%20is%2C%20when%20the%20user%20was%20added%20to%20a%20group%2C%20who%20added%20them%2C%20etc.%20but%20I%20don't%20see%20any%20indication%20of%20which%20group%20the%20user%20was%20added%20to.%26nbsp%3B%3C%2FP%3E%3CP%3EAm%20I%20missing%20something%20here%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-286377%22%20slang%3D%22en-US%22%3ERe%3A%20O365%20Audit%20Log%20Search%20User%20Added%20to%20Group%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-286377%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20will%20not%20see%20the%20group%20name%20from%20the%20SCC%2C%20if%20that's%20what%20you%20are%20after.%20There's%20a%20long%20standing%20bug%20preventing%20this%20information%20from%20showing.%20Instead%2C%20use%20the%20Azure%20AD%20logs%20in%20the%20Azure%20portal%3A%20%3CA%20href%3D%22https%3A%2F%2Fportal.azure.com%2F%23blade%2FMicrosoft_AAD_IAM%2FActiveDirectoryMenuBlade%2FAudit%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fportal.azure.com%2F%23blade%2FMicrosoft_AAD_IAM%2FActiveDirectoryMenuBlade%2FAudit%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

I've run a search using the Added member to group under the Azure AD group administration activities section and that does provide some useful output like; who the user is, when the user was added to a group, who added them, etc. but I don't see any indication of which group the user was added to. 

Am I missing something here? 

1 Reply
best response confirmed by brandon wilson (Occasional Visitor)
Solution

You will not see the group name from the SCC, if that's what you are after. There's a long standing bug preventing this information from showing. Instead, use the Azure AD logs in the Azure portal: https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Audit