User Rewind aggregates audit logs from Microsoft 365 and CoreView, and processes them to display user-related events in a consolidated event list. The dashboard categorizes, groups, and labels actions by event type, actor, and timestamp.
The User Rewind feature tracks the following events:
- User attribute modifications
- Group actions (Teams, Microsoft, Distribution, and Security groups)*
- License assignments
*Note: management actions related to ownership of security and distribution groups are not available in CoreView. These actions are displayed as read-only and cannot be reverted via the CoreView app.
The ability to revert changes to user attributes and service plans/licenses is coming soon.
Reverting changes with User Rewind
The guide below shows how to revert an administrative action that removed a user from a Teams group.
Step 1: locate the user
Search for the affected user by name using the search bar or from the Active Users report.
Step 2: access the user’s change history
- Click on the user to open their user card.
- Select the “Changes” tab.
- The Changes tab displays all user-related events recorded in the previous 30 days. The event retention period is fixed and cannot be adjusted.
- The list can be sorted and filtered by date range.
- The boxes show whether the change was performed on the CoreView app or not, the acting admin/operator, and the timestamp.
Step 3: filter the changes
Use keywords to filter change events, e.g., the Teams group name, to locate actions involving that group.
Step 4: review results
- Review the filtered events. For example, if a user has lost access to a Teams group, check for actions indicating that the user was removed from the group.
- Click “Configuration history” for detailed records of actions involving the user and the group.
Step 5: review group card (optional)
To confirm group membership, open the group card and view the current members and owners.
Step 6: revert changes
- Once the necessary change is identified, select the “Revert” action for that specific event.
- A modal will open displaying the current membership status. Selecting “Apply” will initiate the process to restore the user’s group membership. If no approval is required, the action will be executed immediately. Otherwise, the designated approver in Settings will be notified to review and approve the change.
Step 7: confirm the reversal
- Click “Apply” to submit the reversal.
- CoreView sends the reversal action to Microsoft 365. Upon successful processing, the user’s group membership is restored.
Who can perform User Rewind actions
Tenant admins can perform User Rewind actions and delegate operator permissions as detailed in the “Delegate User Rewind actions” article.