detection.wiki

Microsoft Teams admin activity

OperationDescriptionSampleRule
anyCatch-all for M365-MicrosoftTeamsAdmin rules matching the RecordType but no specific Operation.NN
TeamsAdminActionTeams Admin Action activity in Microsoft Teams admin, recorded in the Unified Audit Log (observed in first-party capture).YY

any: Microsoft Teams admin activity (catch-all)

#
RecordType
MicrosoftTeamsAdmin

Description

Catch-all for M365-MicrosoftTeamsAdmin rules matching the RecordType but no specific Operation.

TeamsAdminAction

#
RecordType
MicrosoftTeamsAdmin

Description

Teams Admin Action activity in Microsoft Teams admin, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "AdminActionDetail": "PATCH /Skype.Policy/configurations/TeamsClientConfiguration/configuration/Global",
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "IssuedAtTime": "2026-07-02T15:39:49Z",
    "UniqueTokenId": "F5gE5rbzLU6L67NJDMtZAA"
  },
  "ClientApplication": "Microsoft.Teams.Policy.Administration/0.0.0/Set-CsTeamsClientConfiguration/MicrosoftTeams/7.8.0",
  "ClientIP": "10.60.0.190",
  "CreationTime": "2026-07-02T15:44:54Z",
  "ExtraProperties": [
    {
      "Key": "CorrelationId",
      "Value": "63895cf4-637b-46b1-956e-61a1270c9207"
    },
    {
      "Key": "X-MS-CmdletName",
      "Value": "Set-CsTeamsClientConfiguration"
    }
  ],
  "Id": "18edac62-78eb-4155-3378-08ded850dcd8",
  "Operation": "TeamsAdminAction",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "RecordType": 57,
  "ResultStatus": "Succeeded",
  "UserClaims": "AuthenticatedUser,GlobalAdmin",
  "UserId": "Admin User",
  "UserKey": "11111111-1111-1111-1111-111111111111",
  "UserType": 2,
  "Version": 1,
  "Workload": "MicrosoftTeams"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

  • Anomalous login followed by Teams action source medium: Detects anomalous IP address usage by user accounts and then checks to see if a suspicious Teams action is performed. Query calculates IP usage Delta for each user account and selects accounts where a delta >= 90% is observed between the most and least used IP. To further reduce results the query performs a prevalence check on the lowest used IP's country, only keeping IP's where the country is unusual for the tenant (dynamic ranges). Please note, if the initial logic of prevalence to find suspicious logon activity is noisy then consider adding filtering based on Location. Finally the user accounts activity within Teams logs is checked for suspicious commands (modifying user privileges or admin actions) during the period the suspicious IP was active.T1078, T1098, T1136, T1199

References #

M365 audit records use different field names on each surface #

The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.

  • Purview CSV export flattens each record to four columns (CreationDate, UserIds, Operations, AuditData). The API field names live only inside the AuditData JSON blob. Expand it with ConvertFrom-Json. The wrapper columns are renamed too: CreationDate not CreationTime, UserIds not UserId, Operations not Operation.
  • Sentinel's OfficeActivity table renames several fields and turns two integer enum columns into strings. The table below maps them.
API JSON (event pages)OfficeActivity columnNote
IdOfficeIdRenamed.
WorkloadOfficeWorkloadRenamed.
ObjectIdOfficeObjectIdRenamed.
CreationTimeTimeGeneratedRenamed. OfficeActivity has no CreationTime column.
SiteUrlSite_UrlRenamed (SharePoint family).
RecordTypeRecordTypeSame name; the Int32 enum becomes its string enum name.
UserTypeUserTypeSame name; the Int32 enum becomes a string.
ClientIPClientIP, Client_IPAddressBoth columns present on OfficeActivity.
Scope(none)No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview AuditData blob.
Operation, UserId, ResultStatus, UserKey, AppAccessContext, OrganizationIdsame namesUnchanged. No _s / _d suffixes (a native table, not a custom log).

Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.