Teams User Addedto Teams Channel
Query
//Query a specific user to check if they were added to a Teams channel in the last 7 days
OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation =~ "MemberAdded"
| where Members contains "UserName"Explanation
This query checks if a specific user has been added to a Teams channel in the last 7 days. It looks at the OfficeActivity logs, filters for events that occurred within the last 7 days, specifically for the "MemberAdded" operation, and checks if the "Members" field contains the specified "UserName".
Details
Rod Trent
Released: September 1, 2020
Tables
OfficeActivity
Keywords
OfficeActivityTimeGeneratedagoOperationMemberAddedMembersUserName
Operators
|where>ago()=~contains