Hello, I'm in need of running a scan on a Sharepoint Online tenant to detect any changes to permission groups. Thank you

Hi @Morales, Emma L STF (CTR) You could use the following code: Search-UnifiedAuditLog -EndDate (Get-Date) -StartDate (Get-Date).AddDays(-90) -Operations "GroupAdded","GroupRemoved" | export-csv c:\AuditReport.csv You could add the cmdlet into "Operations" such as "AddedToGroup","GroupRemoved" as your own need, you could refer to this article to find the cmdlet: https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#site-permissions-activities If an Answer is helpful, please click " Accept Answer " and upvote it. Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

script for scanning permission groups

Accepted answer

Yi Lu_MSFT 17,456 Reputation points

2021-10-08T09:55:18.967+00:00
Hi @Morales, Emma L STF (CTR)
You could use the following code:

Search-UnifiedAuditLog -EndDate (Get-Date) -StartDate (Get-Date).AddDays(-90) -Operations "GroupAdded","GroupRemoved" | export-csv c:\AuditReport.csv

You could add the cmdlet into "Operations" such as "AddedToGroup","GroupRemoved" as your own need, you could refer to this article to find the cmdlet:
https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#site-permissions-activities

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Yi Lu_MSFT 17,456 Reputation points

2021-10-12T01:08:47.597+00:00

Hi @Morales, Emma L STF (CTR)
Would you please provide me with some update of this issue? I am free to hear.

Morales, Emma L STF (CTR) 61 Reputation points

2021-10-19T22:40:06.933+00:00

Hello Yilu,
Thank you for getting back to me. Do I need to run the command you shared in Powershell? Do I need to be an Admin? Also is there a quick tutorial? As you could see, I'm very new to Sharepoint. Thank you

Yi Lu_MSFT 17,456 Reputation points

2021-10-26T08:14:55.747+00:00

Hi @Morales, Emma L STF (CTR)
This is run by Exchange online management shell.

You need to install the module in powershell first, you could refer to this article for the steps:
https://thesysadminchannel.com/how-to-install-exchange-online-powershell-module/

If you get error when you run the code as the article shows, you may need to update the version of your powershell, you could get the new version as your need from this link:
https://github.com/PowerShell/powershell/releases

As a result, after running the code I provided in the answer, you will get an excel file.

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

Morales, Emma L STF (CTR) 61 Reputation points

2021-10-26T21:37:43.877+00:00

Hi Yilu, These were good instructions thank you. I wrestled with installing version 7. Then, I was stuck with running command: Connect-ExchangeOnline -UserPrincipalName upn@keyman .com ... It told me, Create Powershell Session is failed using OAuth. I tried to activate basic authentication, but could not. So I couldn't run the command Search-UnifiedAuditLog which you were kind and generous to provide at the beginning of this journey. I also wasn't sure if I have to set the directory to 'PS C:\>' when running Install-Module -Name ExchangeOnlineManagement -Scope AllUsers. I did so because that's what shows on the instructions you provided.

How can I enable Baasic Auth so I can run 'Connect-ExchangeOnline -UserPrincipalName upn@keyman .com'

Yi Lu_MSFT 17,456 Reputation points

2021-10-27T01:48:33.14+00:00

Hi @Morales, Emma L STF (CTR)
This is my whole test process after installing 7.15 version, you could refer to the screenshot:

Morales, Emma L STF (CTR) 61 Reputation points

2021-10-27T16:57:32.637+00:00

Hi Yilu, I see that you are signed in as an Admin. Is there a script for non admins? Or way to pass non-admin credentials to the command: Install-Module -Name ExchangeOnlineManagement -Scope AllUsers

Yi Lu_MSFT 17,456 Reputation points

2021-10-29T09:56:18.797+00:00

I am afraid the answer is no, per my test, if I don't open powershell with "Run as administrator", I will meet the same error.
Sign in to comment

script for scanning permission groups

0 additional answers