question

BelanMarek avatar image
0 Votes"
BelanMarek asked BelanMarek commented

Defender for Cloud Apps and Universal / Distribution group membership

We can see who add/remove user to group when this group is Universal / Distribution.
When it's security group we see account who add user to this group.

166329-image.png


windows-active-directory
image.png (48.8 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

Thameur-BOURBITA avatar image
1 Vote"
Thameur-BOURBITA answered BelanMarek commented

Hi,

Try enable audit on active directory object. The audit let you track any change on universal group.

use-audit-active-directory-objects-track-events




Please don't forget to mark helpfull reply as answer

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

As i write security groups is ok so audit is enabled , in third party tool we see all data in event log data is too.

0 Votes 0 ·