SharePoint Group Permission change Tracking

Navas Shereef 141

Hi all,

We have a SharePoint site and we added domain group and gave read permission to the group. But recently, someone changed the group permission to edit. We tried to use inbuild audit report in site setting but it keeps on loading and returned nothing.

Is compliance audit able to track the user who made the change?

Navas Shereef 141 Reputation points

2022-02-16T11:43:43.44+00:00

Also, tried to retrieve using Rest API. I didnt get any details about permission updated user.

/_api/Web/RoleAssignments/GetByPrincipalId(27)?$select=author,modified&$expand=Member/user,RoleDefinitionBindings

1 answer

Emily Du-MSFT 45,581 Reputation points Microsoft Vendor

2022-02-17T02:54:12.453+00:00

@Navas Shereef

To check audit logs for site group, you could go to Microsoft 365 admin center -> Compliance -> Audit -> Select Start and End time -> Choose Updated group in the Activities box.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Navas Shereef 141 Reputation points

2022-02-17T07:43:55.643+00:00

Hi,

Thanks for the reply. We have tried both Updated group and modified site permission as activity in audit log and returned no data. Is there any other way to find who changed the group permission? Also, it is a domain group not SP group. Someone changed the site level permission of domain group. We need to find who did that.

Emily Du-MSFT 45,581 Reputation points Microsoft Vendor

2022-02-17T09:20:28.223+00:00

@Navas Shereef

For domain group, it cannot be achieved by audit logs.

I consult the development engineer, it also cannot be acheive by API.

Navas Shereef 141 Reputation points

2022-02-17T09:50:19.547+00:00

Can Microsoft help if we raise a ticket?

Emily Du-MSFT 45,581 Reputation points Microsoft Vendor

2022-02-18T06:34:55.297+00:00

@Navas Shereef

Yes, you could open a ticket with Microsoft.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

SharePoint Group Permission change Tracking

1 answer

Your answer