MicrosoftMicrosoft
MicrosoftTake the application ID and search against your enterprise applications within the Entra ID admin portal.
I've tried that as well, I cleared all filters and tried using the ID in the search field, and also setting only 1 filter with "Application ID starts with {App-ID}", but I'm still not seeing any hits for any of the App ID's found from the script. I verified I am in the correct tenant, given the Organization ID. Not sure what I'm missing.
MicrosoftAnother option is to use Graph:
Import-Module Microsoft.Graph.Applications
Get-MgApplication -ApplicationId 'xxxxxxxxxxxxx'
Looking through the events, I think all of my results are from users creating/editing groups? Looking at the events that have an Operation of "Create", when I look at these mailboxes, they are group mailboxes, and the audit log for that group shows it was created by a user.
Under the creation event, the "Initiated by (actor)" shows a user's UPN (user @ contso.com), but then next to Display Name it shows Microsoft Teams Services.
I have a feeling that all of these IDs I can't translate to an application are Group changes made by the Microsoft Teams Services.
The SID listed under UserID is the same for every entry as well:
S-1-5-80-447828073-3829008076-3733868015-3112024911-3885364408
