Forum Discussion
Seemingly random "{user} has been removed from this team"
In my case it was a user disabled in AD and when removed from a team it used a random owner name for the message. Per Microsoft it is a bug: "Also mentioned in the article above that there is planned work to move this to a system context so it will not show up as a random owner doing it but there is no timeline at this time." Here is the link they send me to:
https://techcommunity.microsoft.com/t5/microsoft-teams/disabled-users-removed-from-teams/m-p/1284519
I had another occurrence of this issue where a user was not disabled in AD. I continued to troubleshoot it with Microsoft and today I received the final verdict:
"After investigating internally, confirmed that this is a known issue where Team would display the owner's name for removing the user from the team even though the owner has not removed it.
Mainly it has to do with the AAD sync cycle in the background where the sync cycle does not have the actor information, so it displays the random owner name in Teams.
Engineers are aware of this issue as multiple tenants have reported it and many ICM's are also being created for the same issue.
Engineers have acknowledged the issue and advised that they will be investigating it but at this point time they do not have any ETA for the resolution.
Changes made will be made in the future to prevent this behavior from happening again."
Igor Karonthanks for sharing the MS response, very helpful. I've recently noticed this in our organisation too when an owner of a fairly large public Teams raise a security incident as she noticed some members were shown as removed/added while the owner was on leave!
(In our case, we had a clean-up script that did disable these members in AD due to inactivity.)
although, what I find interesting is that both the O365 compliance UnifiedAuditLogs and MCAS (Microsoft Cloud App security) both record this event against the owners name and show as if performed by the owner. This threw us off as a possible security incident until I saw this thread!
(excerpts from UAL below:)
Activity: Removed membersDetail: AuditSearchResultDetail_MemberRemoved
Operation: MemberRemoved
RecordType: 25
Workload: MicrosoftTeamsMicrosoft needs to add this issue to the list of known Teams issues here:
https://docs.microsoft.com/en-us/microsoftteams/troubleshoot/teams-welcome
Dear Igor Karon
Thanks for initiating an investigation into this issue. The response you have drawn from Microsoft is most helpful and I will let colleagues know about it. Hope all well with you and thanks again.
Regards from, Phil
