Skype for Business / Teams PowerShell cmdlet events

Operation	Description	Sample	Rule
any	Catch-all for M365-SkypeForBusinessCmdlets rules matching the RecordType but no specific Operation.	N	N
Set-CsTeamsClientConfiguration	The Teams client configuration for the organization was changed via the Teams/Skype PowerShell module.	N	Y
Set-CsTenantFederationConfiguration	The Teams/Skype for Business tenant federation configuration was changed, controlling external communication.	N	Y

any: Skype for Business / Teams PowerShell cmdlet events (catch-all)

RecordType: SkypeForBusinessCmdlets

Description

Catch-all for M365-SkypeForBusinessCmdlets rules matching the RecordType but no specific Operation.

Set-CsTeamsClientConfiguration

RecordType: SkypeForBusinessCmdlets

Description

The Teams client configuration for the organization was changed via the Teams/Skype PowerShell module.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Provider_Name` (elastic rule field)	in	`microsoftteams`	1 rule	elastic
`Provider_Name` (elastic rule field)	in	`skypeforbusiness`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Deprecated - M365 Teams Guest Access Enabled source medium: Identifies when guest access is enabled in Microsoft Teams. Guest access in Teams allows people outside the organization to access teams and channels. An adversary may enable guest access to maintain persistence in an environment.T1098, T1484

Set-CsTenantFederationConfiguration

RecordType: SkypeForBusinessCmdlets

Description

The Teams/Skype for Business tenant federation configuration was changed, controlling external communication.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Provider_Name` (elastic rule field)	in	`microsoftteams`	1 rule	elastic
`Provider_Name` (elastic rule field)	in	`skypeforbusiness`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Deprecated - M365 Teams External Access Enabled source medium: Identifies when external access is enabled in Microsoft Teams. External access lets Teams and Skype for Business users communicate with other users that are outside their organization. An adversary may enable external access or add an allowed domain to exfiltrate data or maintain persistence in an environment.T1484, T1562

References #

M365 audit records use different field names on each surface #

The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.

Purview CSV export flattens each record to four columns (CreationDate, UserIds, Operations, AuditData). The API field names live only inside the AuditData JSON blob. Expand it with ConvertFrom-Json. The wrapper columns are renamed too: CreationDate not CreationTime, UserIds not UserId, Operations not Operation.
Sentinel's OfficeActivity table renames several fields and turns two integer enum columns into strings. The table below maps them.

API JSON (event pages)	OfficeActivity column	Note
`Id`	`OfficeId`	Renamed.
`Workload`	`OfficeWorkload`	Renamed.
`ObjectId`	`OfficeObjectId`	Renamed.
`CreationTime`	`TimeGenerated`	Renamed. OfficeActivity has no `CreationTime` column.
`SiteUrl`	`Site_Url`	Renamed (SharePoint family).
`RecordType`	`RecordType`	Same name; the Int32 enum becomes its string enum name.
`UserType`	`UserType`	Same name; the Int32 enum becomes a string.
`ClientIP`	`ClientIP`, `Client_IPAddress`	Both columns present on OfficeActivity.
`Scope`	(none)	No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview `AuditData` blob.
`Operation`, `UserId`, `ResultStatus`, `UserKey`, `AppAccessContext`, `OrganizationId`	same names	Unchanged. No `_s` / `_d` suffixes (a native table, not a custom log).

Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.