A member who was removed from a private team was somehow added automatically to the same private team again. How can that happen? I thought you can only manually add members to a private team. Any ideas?
This pointed me in the right direction. Looking at the audit log, the user was added "automatically" when a non-member of said Teams group was assigned to an integrated Planner task. Apparently, it is possible to assign non-members to a Planner task within a private Teams group. By doing so, the previous non-member now becomes a member to the Teams group and thus to all private content. Is this a bug or desired behavior? I haven't found away to restrict such an unwanted action that compromises data privacy. There should at least be an alert that notifies the user of the consequences of such an action.