[Feedback on feature] SCIM-synced Teams - audit logs

[#1]

Hey everyone,

I'm April, a product manager in Atlassian Teams 👋 Looking to keep you all involved in the process - looking for some feedback below. 

What we're building 🔨

We're building SCIM-synced Teams. This is where you can sync your Groups backed by an identity provider such as ActiveDirectory to Atlassian Teams and avoid manual overhead in updating the Teams.

 There will be two ways to mirror/link a team: 

- Link a group to an existing team

- Link a group to a a new team (it will create the team for you)

As a part of this, we're surfacing important Team events in the audit log in AdminHub for SCIM-synced Teams.

Where we want your feedback 🙏

Pertaining to the audit log:

- would you prefer option (1) or option (2)? 

- How do you use audit logs?

- What do you look for in audit logs?

Option 1:

Audit log shows the following about whether it's a new or existing team synced to group. For example, the activity will show:

- 'Connected a new team called <team name> to the <group name> '

- 'Connected an existing team called <team name> to the <group name>'

Option 2

Audit log shows creation and linking/mirror of a Team a separate events. You can then surmise whether it's a new or existing team through timestamps. 

- 'Team x created'

- 'Team x linked to group'

Which one do you prefer? How do you use audit logs and what do you look for in them?

Look forward to your responses and thank you for your valuable feedback! Let me know if you have any other comments or questions related to SCIM-synced Teams, we have expect to have expressions of interest for our EAP soon. 

[Nik Marsh]

Wow what an exciting update!

• I would prefer option 1 makes an administrators job much easier and less room for mistakes or audit issues.
• We use audit logs primarily for troubleshooting , Internal Audits, and SOX audits.
• What I look for in logs is Event(as verbose as possible), Actor, Target, Timestamp,Success / Failure Codes, Location , IP Address, email, username, AlternateID

[April Chi]

Hey @Nik Marsh ,

Thank you, noted 🙏 Will you keep you up to date here once we're ready to take early access program customers! 

[James Rickards _Spark-Nel_]

RE: Audit logs:

I prefer option 1, as it allows searching via the team name or the group name, but I understand that data storage costs $, so option 2 is OK if it keeps the product ever so slightly cheaper to operate.

What is more critical is WHO made the change.

Generally, I use audit logs for two purposes...

1.) Checking who changed something because it broke something, so we can undo it and do some user training with the offender.

2.) Sending to SIEM analysis with rules to check if someone accidentally gained access to an admin feature (but currently we don't do this as it's not supported yet).