A reader question asked if it was possible to find the last app accessed by a user. Of course, anything is possible with PowerShell, but how? In this article, we explore using the Entra ID sign-in logs and Microsoft 365 audit log as sources for finding the desired information. Some performance issues emerge, so we end up running the code in Azure Automation.
The unified audit log is the source of a lot of information about a Microsoft 365 tenant. The Search-UnifiedAuditLog cmdlet is available to search the audit log and now we have the AuditLog Graph API. This article explains how to use the new API to query and retrieve audit records from the log.
Despite making a commitment to generate MailItemsAccessed events for customers with Microsoft Purview Audit (Standard) licenses in July 2023, Microsoft won't ship the necessary updates until June 2024.
Microsoft has changed the way that the Search-UnifiedAuditLog cmdlet works without saying anything to Microsoft 365 customers. The results is that some scripts don't work and others won't return the expected results. This article explains what's happened and offers a workaround. Microsoft's actions are unexplainable, but it's the norm in this area where audit log changes happen without communication all the time.
Organizations often disable Azure AD accounts when users leave or for other reasons. What you might not know is that Teams then removes the account from membership of individual teams. A background process looks for disabled users and removes these accounts from team memberships. That doesn't sound too bad, but what's horrible is when you unblock an account. Teams takes a long time (at least 24 hours) to restore standard teams, it might not ever restore membership of org-wide teams, and private channel membership is removed too. It's not a good situation.
