Query Details
Office Activity Shared Teams Channel Created
Query
//Detect when a shared Teams channel is created //Data connector required for this query - Office 365 OfficeActivity | where Operation == "ChannelAdded" | where ChannelType == "Shared" | project TimeGenerated, Actor=UserId, TeamName, ChannelType, ChannelName
Explanation
This query is looking for when a shared Teams channel is created. It uses the Office 365 data connector and filters the OfficeActivity table for entries where the Operation is "ChannelAdded" and the ChannelType is "Shared". The query then projects the TimeGenerated, Actor (UserId), TeamName, ChannelType, and ChannelName.
Details
Matt Zorich
Released: June 17, 2022
Tables
OfficeActivity
Keywords
OfficeActivity,Operation,ChannelAdded,ChannelType,Shared,TimeGenerated,Actor,UserId,TeamName,ChannelName
Operators
| where==| project