How to find user join date for O365 groups?

Is user join date a audit able field in O365 groups? I am attempting to determine when a user joined a group and then when they left. The user may have had access to files they are were not authorized to access.

Hi Eamon O'Huallachain,   

Greetings, sorry to keep you waiting, many thanks for your patience.

Regarding your question to search ModifiedProperties for NewValue / OldValue { "Name": "Group.DisplayName", "NewValue": "TheGroup", "OldValue": "" }, I have consulted our senior engineer and test below commands multiple times and it works as expected on my side (see below picture), please kindly try this on your side and share the result with us:

$results = Search-UnifiedAuditLog -StartDate 6/1/19 -EndDate 6/30/19 -RecordType AzureActiveDirectory -Operations "Remove member from group" -ObjectId ""     

$outcomes = $results.AuditData | ConvertFrom-json | Select ModifiedProperties

Foreach ($element in $outcomes){$element.ModifiedProperties[1]}

Moreover, please allow me to apologize for delivering not completely correct information in my first reply. I did more research and find that we can find user join/leave group data in the Security & Compliance center > Search > Audit log search > find Azure AD group administration activities and select "Added member to group“ & "Removed member from Group", then set the data range and other conditions, for your reference: 

Hope above information helps, please feel free to let me know if there is anything unclear, I'll glad to provide further suggestions.

Best regards,


* Beware of scammers posting fake support numbers here.

* Kindly Mark and Vote this reply if it helps please, as it will be beneficial to more Community members reading here.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.


Question Info

Last updated October 15, 2020 Views 281 Applies to: