I have an ArcGIS Survey123 form in AGO, and noticed that the item was last updated on Nov 3, 2024. It was not updated by me or anyone on our team. Is there any way to find out who updated it or what was modified?
I checked our activity report and noticed the updates were done by a strange client id using an IP address that was nowhere near my location. I submitted a report to Esri Product Security Incident Response and they confirmed the client ID is from Microsoft Power Automate. This makes sense as power automate uses a webhook attached to this survey. The web hook shows that it was modified, which was the same date and time as the last modified date of the form item. I'm not sure what it was modifying, but this seems to make sense.
If your Automations are consolidated to a single account, it should be relatively easy to track down the flow. If not, you may need to play telephone-tag to figure out what is going on.
