Group Membership Change Audit Log

Overview

This flow monitors an Office 365 Group for membership changes by comparing current group members against a baseline stored in SharePoint. When members are added or removed, the changes are logged to a SharePoint audit list and an alert email is sent to the designated administrator. Runs daily at 7:00 AM UTC.

Use Case

IT administrators need visibility into who joins or leaves security and collaboration groups. Manual checks are time-consuming and error-prone. This flow automates the audit by taking a daily snapshot of group members, comparing against the previous day's baseline, logging additions and removals with timestamps, and alerting admins immediately when changes occur. Ideal for compliance audits, access reviews, and security monitoring.

The flow is ideal for teams that:

• Taking a daily snapshot of group members
• Comparing against the previous day's baseline
• Logging additions and removals with timestamps
• Alerting admins immediately when changes occur

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Monitor a different group

Update the flowlibs_MonitoredGroupId and flowlibs_MonitoredGroupName environment variables with the target group's GUID and display name.

Change alert recipients

Update flowlibs_AuditAlertRecipient to any valid email address or distribution list.

Monitor multiple groups

Duplicate the flow and create separate baseline/audit lists per group, or enhance the flow with an array variable of group IDs and a nested Apply to Each.

Change the schedule

Modify the Recurrence trigger frequency and schedule parameters to run more or less often.

Deploy to another tenant

Update all environment variable values, create new SharePoint lists matching the expected names, and update connection references to valid connections in the target tenant.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@equals(item()?['UserEmail'], items('Loop_Through_Current_Group_Members')?['mail'])

@equals(item()?['mail'], items('Loop_Through_Baseline_to_Find_Removals')?['UserEmail'])

@{variables('varGroupName')} - @{items('Loop_Through_Current_Group_Members')?['displayName']} - Added

@utcNow()