AzureFeeds

Hi, Insiders! I’m Katarina Tranker, and I’m a Product Manager on the Teams team. I’m excited to share that we’re bringing enhanced security telemetry to enable customers to get the security data and information they need on screensharing and Take, Give, and Request control activities in Microsoft Teams. 

Audit logs for screensharing and Take control for Teams admins

Audit logs are critical to understand activity on Teams and during Teams meetings, allowing admins to detect and prevent suspicious or malicious activity as quickly as possible. It also enables admins to spot data leakages, such as the case where sensitive or confidential content is shared with outside parties.

We’re thrilled to bring more data to audit logs with timestamps and information regarding screensharing in Teams meetings, such as:

• Who joined a meeting where screensharing occurred?


• Who started a screenshare?


• When did screensharing occur, and when did it stop?


• When and by whom was screensharing started or Take, Give, or Request control activated, was the request accepted, and by whom was it accepted?


• Whom was the content shared with?

How it works

1. To view information in audit logs around screensharing and Take control in Teams, navigate to the Microsoft Purview portal and sign in with your admin credentials.


2. Select Audit in the left-hand navigation pane, then select New Search.


3. Select the dates and timeframe you’d like to view logs, set the Activities – operation names to “MeetingParticipantDetail” or write “screenShared” in the Keyword Search box, then select Search.

Tips and tricks

• To export the logs to a CSV file, select the Export button.

Availability

The audit logs for screensharing and Take control are available to all Teams admins.

Feedback

We’d love to hear how we can improve upon audit logs! You can share feedback by submitting a Design Change Request through your Microsoft support channels, or directly via your customer PMs to ensure your input is formally tracked and reviewed by the product team for potential improvements. Admins participating in the Teams Technology Adoption Program can provide feedback through their assigned TAP PMs or by using the TAP mailing tool to reach tenant contacts.

Learn about the Microsoft 365 Insider program and sign up for the Microsoft 365 Insider newsletter to get the latest information about Insider features in your inbox once a month!