Microsoft Teams Boosts Meeting Security with Advanced Audit Logging Capabilities

Microsoft is enhancing security and transparency in Teams meetings with new audit logging capabilities for screen sharing and control actions, such as Take, Give, and Request control. These new logs give IT admins deeper visibility into user behavior, which helps them detect suspicious activity and maintain compliance more effectively.

Audit logs in Microsoft Teams are records that capture detailed information about user and admin activities within the platform to help organizations monitor usage and ensure compliance. These logs include actions like message sent, file shared, user login, team creation, and changes to settings. They are accessible through Microsoft Purview or the Microsoft 365 compliance center.

Microsoft Teams has enhanced its audit logs to include detailed records of screensharing and control actions during meetings. These logs now capture key information such as who participated in meetings where screensharing occurred, who initiated or ended a screenshare, the exact timing of these actions, and details about control requests like who requested, accepted, or gave control, and to whom the content was shared.

How to access the new audit logs?

To view information in audit logs about screensharing and Take control in Microsoft Teams, administrators will need to follow the steps mentioned below:

• Navigate to the Microsoft Purview portal and sign in with the admin credentials.
• Click Audit in the left-hand navigation pane, and select New Search.
• Select the dates and timeframe to view logs, set the Activities – operation names to “MeetingParticipantDetail” or write “screenShared” in the Keyword Search box, and select the Search option.

Microsoft notes that audit logs for screensharing and Take control actions are now available to all Teams administrators, with the option to export them as CSV files for further analysis.

Other updates

Microsoft has also rolled out a couple of other new capabilities for its Teams collaboration service in July. Administrators can now remotely collect client diagnostics logs from users’ devices. There is also a new feature that lets IT admins create specific criteria for permitting third-party SaaS applications within their tenant.

Lastly, Microsoft has introduced a new best practice configuration dashboard in the Teams admin center. It helps to monitor DNS and proxy issues that can lead to issues such as call drops, login failures, or poor real-time media quality. Microsoft has also enabled the transcription policy for all new tenants by default.