You can help support this website by buying me a coffee!
1 minute reading time
(195 words)
Find who created a user in Office 365 (Azure AD) by searching the audit log
How to find out who created a user in Office 365 (Azure AD) by searching the audit log in the Azure portal
In this example, we want to check which administrator created a user account in Office 365. We can find out by searching the Azure AD audit logs.
Search audit logs using the Azure portal
If the user account was created in the last month, you can search the audit logs from the Azure portal.
Logon to the Azure Portal
Azure Active Directory - Users
Logon to the Azure Portal
Azure Active Directory - Users
Select the user account
Audit logs
Filter by activity - Add user
In this example, we can see that itadmin created the user account
If you are looking for events older than 1 month, you'll need to use Exchange Online PowerShell Search-UnifiedAuditLog
Search the Office 365 (Azure AD) audit log using PowerShell Search-UnifiedAuditLog and export to CSV - TechLabs
How to search the Office 365 (Azure AD) audit log using PowerShell Search-UnifiedAuditLog and export to CSV file.
Comments