Disabled users removed from Teams

[Raechel Moermond]

I have a customer that wants to know why a team owner was selected as having removed users from a team when he didn't remove them.  The scenario:

Three users were disabled in AD. They were not removed from syncing to O365.  My customer believes this removed them from all team sites.

One team has 12 owners and the activity for the team (user joined the team, user left the team, owner removed user from team) shows that OwnerD removed all 3 members from the team.  So my customer wants to know why that Owner was selected instead of one of the other 11 owners and how this selection process happens.  There is concern because that owner did not remove the users from the team and now there is a log stating he did.  If disabling the users is what cause them to be removed from the team (which to me, personally, does not make sense but all I got to work with is what I've been told has happened by the customer), why doesn't it say something like "system removed user from the team"?

I'm also looking into the O365 Log as well as talking to the customer to see if I can figure out what happened, but this owner is adamant that he did not remove these users from the team.

[#2]

Do not disable their user accounts in AD, just set the allowed login days / hours

[#3]

@_Przemek_ would that restrict access to Office 365?  Considering that expired accounts can still access O365 I'd be surprised if changing the allowed days sync's to Office 365.  I do like the idea though! 

[#4]

You can block Office365 users on admin.microsoft.com Find the user in Active Users and modify their account. Under the Settings section, change the "Set Sign In Status" to Blocked. Or use the Pwoershell script: https://docs.microsoft.com/en-us/microsoft-365/enterprise/block-user-accounts-with- microsoft-365-powershell? view = o365-worldwide

[#5]

@_Przemek_ Thanks for your suggestions, I've now got a script that modifies the logon hours in AD to prevent uses logging on or connecting VPN and then also blocking the sign-in in O365 to prevent them accessing resources there.