I'm in a bit of a bind. Someone recently changed the logo in our M365 admin portal under Settings -> Org Settings -> Organization Profile -> Custom Themes -> Default Theme -> Logos. Now, a logo from a completely different company is showing up on all our SharePoint pages. We managed to fix it quickly once we noticed, but I'm concerned about how this happened. We have a SharePoint consultant who works with various companies; could they have made this change that affected our tenant? I'm looking for ways to audit this change. I've checked AdminDroid and the Purview/Compliance Center, but haven't found anything. Any advice?
3 Answers
It sounds frustrating, but if the consultant was involved, it's possible they reversed something unintentionally. Definitely check all access logs to troubleshoot this better.
You should definitely pull the UAL logs; they should help you identify who made the change. Honestly, if you’re seeing logos from other companies, this might be more common than we think!
For sure! Just remember that if others had access to your admin portal, you'll want to figure out who had permissions during the time of the change.
Haha, this is wild! While I can’t help with your specific issue, it sounds like it might have been a consultant who accidentally uploaded the wrong logo. To audit changes like this, you might want to check the Unified Audit Log (UAL) for M365. It can give you a rundown of changes made within your tenant, including who changed what.
Definitely! Just keep in mind that sometimes logs can take a bit to update, so give it some time before panicking.
Right? And if the consultant has permissions in your tenant, that could complicate accountability.
Yeah, it's buried in there, but the UAL is key! Make sure you export the logs to get a clearer picture.