Get-WhoAssignedUser

Ever wondered who assigned permission directly to a user in a SharePoint site? This script searches the Microsoft 365 unified audit log for "AddedToGroup" events on a specific SharePoint site, scoped to a specific user, to answer a common access-review question: who added this person to a SharePoint group, and when. It's built for exactly that question rather than general audit log exploration — point it at a site and a user, and it returns a sorted list of matching group-membership events with the actor, the site, the target user, and the raw event detail, which usually names the SharePoint group itself.

Purpose

• Connects to Exchange Online PowerShell, where Search-UnifiedAuditLog lives
• Searches the unified audit log for AddedToGroup events over the last 180 days, scoped server-side to the target site via -ObjectIds and to the target user via -FreeText
• Parses each matching record's AuditData JSON into a flat object: date, actor, site, target user, and the raw event detail
• Re-filters client-side on the site URL as a second check, then sorts the results chronologically

Scope

• Only catches the AddedToGroup operation — group membership additions. It won't surface permissions granted via a direct sharing link or an item-level permission grant that doesn't go through a SharePoint group
• -FreeText is a free-text match against the whole audit record, not a precise field match — use the person's UPN or exact display name to cut down on false matches, and double-check Detail on anything that looks borderline
• The lookback window is hardcoded to 180 days; if your tenant's audit log retention is shorter, older events won't be there to find, and if it's longer (Audit Premium / E5), this script won't look back far enough on its own — adjust -StartDate if needed
• -ResultSize is capped at 5000, the maximum Search-UnifiedAuditLog allows in a single call — unlikely to be hit for one site and one user, but a very broad $site value could run into it
• Requires unified audit logging to be enabled for the tenant and the records to still be within the retention window — events outside it are gone, not just unsearched

Prerequisites

• ExchangeOnlineManagement PowerShell module installed
• Audit Logs or View-Only Audit Logs role in the Microsoft Purview compliance portal, to run Search-UnifiedAuditLog
• The target SharePoint site URL and a precise identifier (UPN or exact display name) for the user being searched for

<#
.SYNOPSIS
    Searches the Microsoft 365 unified audit log for "AddedToGroup" events
    on a specific SharePoint site, scoped to a specific user, to find who
    added that user to a SharePoint group and when.
#>

Connect-ExchangeOnline

$user = ""   # UPN or exact display name of the user to search for
$site = ""   # SharePoint site URL (or prefix) to scope the search to

$results = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-180) -EndDate (Get-Date) `
  -Operations "AddedToGroup" -ObjectIds "$site*" -FreeText $user -ResultSize 5000

$results | ForEach-Object {
    $d = $_.AuditData | ConvertFrom-Json
    [pscustomobject]@{
        Date   = $_.CreationDate
        Actor  = $_.UserIds                  # who performed the add
        Site   = $d.SiteUrl
        Target = $d.TargetUserOrGroupName    # should match $user
        Detail = $d.EventData                # contains the SharePoint group name
    }
} | Where-Object { $_.Site -like "$site*" } | Sort-Object Date