Have you ever have problem with users that are removed from a group and missing who remove the user from the group? With Azure ATP it is now possible to show that kind of information. You can also enabled monitoring and alert to get that information.

Sign-in to Cloud App Security https://customer.portal.cloudappsecurity.com and open Investigate menu to push the Activity log.

Under APP: choose Active Directory as source to filter for the information.

Under ACTIVITY TYPE: choose Group Membership changed to filter out only changes to groups. With this filter we get both add and remove from the group.

Next is to filter for a users that is removed from the group. That is not possible be course the username is in the Activity field. To solve the problem we need to export the result to csv file.

Within the csv file you can add filters and search for the user and get the result.