Audit log - Teams membership changes

[jbravovich]

Has anyone seen this behaviour before?

In multiple teams it is showing one on the owners has having removed or added members of the team when they have not done so.

Today a deleted account was shown as removed from the team by an owner that has not logged in for over a month. This is showing in the team's general channels chat - "Owner" has removed "user" from the team.

I also confirmed in the audit log that it is showing as the owner that performed the action.

The used has no login logs though so I don't believe they did this.

Does Teams record an owner of the team as having performed an automated action?

[#2]

They recently changed the behavior on that, some actions are now being shown as performed by "random" owner of the Team. Don't ask my why, accountability is probably the last thing they though of...

[#3]

@jbravovich I have noticed this across multiple tenants recently and I haven't found any documentation to support why this is happening. I found that when using the Admin Portal and adding\removing members from a team that you're not a part of, this happens

[#4]

@jbravovich I caught this on another feed here (https://techcommunity.microsoft.com/t5/microsoft-teams/disabled-users-removed-from-teams/m-p/1284519...), There's also the request to remove the "user added to team" "user deleted from team" message that's annoying. Your up-vote could help here (https://microsoftteams.uservoice.com/forums/555103-public/suggestions/35515990-users-added-to-team-l...).

This doesn't solve it, but hopefully helps you.