Information
User role group changes should be reviewed on a weekly basis to ensure no one has been improperly added to an administrative role.
Rationale:
Illicit role group changes could give an attacker elevated privileges to perform more dangerous and impactful things in your tenancy.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
To review user role group changes, perform the following steps using the Microsoft 365 Admin Center:
Go to Compliance Center.
Select Audit under Solutions.
From the Search tab (default), set Set Start Date and End Date.
Expand Search then select Audit Log Search.
In Activities, search for and select Added member to role.
Click Search.
Review.
To review user role group changes, perform the following steps using Exchange Online PowerShell Module:
Connect to Exchange Online using Connect-ExchangeOnline.
Run the following Exchange Online PowerShell command:
$startDate = ((Get-date).AddDays(-7)).ToShortDateString()
$endDate = (Get-date).ToShortDateString()
Search-UnifiedAuditLog -StartDate $startDate -EndDate $endDate | Where-Object { $_.Operations -eq 'Add member to role.' }
Review the output