Query Details
Teams User Addedto Teams Channel
Query
//Query a specific user to check if they were added to a Teams channel in the last 7 days OfficeActivity | where TimeGenerated > ago(7d) | where Operation =~ "MemberAdded" | where Members contains "UserName"
Explanation
This query checks if a specific user has been added to a Teams channel in the last 7 days. It looks at the OfficeActivity logs, filters for events that occurred within the last 7 days, specifically for the "MemberAdded" operation, and checks if the "Members" field contains the specified "UserName".
Details
Rod Trent
Released: September 1, 2020
Tables
OfficeActivity
Keywords
OfficeActivity,TimeGenerated,ago,Operation,MemberAdded,Members,UserName
Operators
|where>ago()=~contains