Hi All
i have an unified group(i.e office365 unified group) created from Office365. i want to know membership details i.e who has added/removed users to this group. This group will also be visible in Azure AD. i can check audit logs in Azure AD and it shows only for a month. i am trying below splunk query to fetch membership information from both Azure AD and office365 but i am not getting output. ug@contoso.com is my group name
sourcetype=azure*:management:activity (Operation="*Change user*" OR Operation="*Update user*") ObjectId="*ug@contoso.com*" (UserId!="Certificate" AND UserId!="ServicePrincipal*" AND UserId!="Sync*") (ModifiedProperties{}.NewValue!=" " AND ModifiedProperties{}.OldValue!=" ")
| rename ModifiedProperties{}.NewValue AS ModAdd
| rename ModifiedProperties{}.OldValue AS ModRem
| rename UserId AS "Actioned By"
| rename Operation AS "Action"
| rename ObjectId AS "Member"
| sort -_time
| table _time, ModAdd, ModRem, "Action", Member, "Actioned By"
... View more