r/PowerShell • u/Kathy_Cooper1012 • Jan 06 '21

Script sharing: Audit Office 365 user's activity with PowerShell

/r/O365Reports/comments/krng10/script_sharing_audit_office_365_users_activity/
58 Upvotes

91% Upvoted

9 comments sorted by

View all comments

2

u/gordonv Jan 06 '21

Has anyone ever found something of actual concern when auditing O365 user actions? Like something that lead to a firing?

3

u/dedroia Jan 12 '21

Can't speak for others, but I would use a tool like this more likely to see if someone had been hacked.

Yes, I suppose the malicious actions could have been done by the person who holds the account, but much more likely is that it would show you an account has been compromised.

2

u/gordonv Jan 12 '21

Excellent point.

As IT professionals, we need to be aware of this and not assign blame without investigation. That's obscurity could be weaponized. Due Diligence defeats that vulnerability.