Teams Was User Role Changed
Query
//Was a user's role changed for a Team in the last 7 days
OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation =~ "MemberRoleChanged"
| where Members contains "Role" and Members contains "1"Explanation
This query checks if a user's role was changed for a Team in the last 7 days. It looks at the OfficeActivity data, filters for events that occurred within the past week, and specifically looks for events related to changing member roles. It further filters for events where the Members field contains both "Role" and "1".