How do you audit changes to delegation in ARS

Question

I can't find any change history that shows when a user was given delegated access to manage a group in AD via ARS. Is this recorded somewhere?

Aidar.Karabalaev · Answer

that is interesting question. I would look at following points: #1. AT Links explicit. Permissions/Roles/AT links: ARS Admin will be able to see Delegation Control (the permission link) on OU (MU, AD object) itself and therefore Change History of the Delegation Control #2. Resulting Delegation. On each AD Object: AD ADmin can see resulting cumulative permission hitting the object from all "entry-link" points (OU, MU, explicit). #3. Well-known SIDs: Built-in\Primary Owner, Built-in\Secondary Owner, Built-in\SELF (when the SID of actually authenticated user is not known apriori and resolved on-fly depending on the object itself). If you see the SID in resulting permission /AT Links on AD object (group), then, for example, Secondary Owner is set on the AD\group has rights given by the linked AT