Seemingly random "{user} has been removed from this team"

Copper Contributor

Hi there. A customer of mine has reported that a Team their staff used this morning presented a message in the feed saying "{User} has been removed from the Team." The user in question definitely has not been, they've just gone on holiday. I've seen a couple of other cases there where this message has shown in the feed when we're sure it shouldn't. Unfortunately, as the person is on holiday I can't ask them to confirm that they have access, but my customer is certain nobody removed them.

 

I've been unable to find anything that could explain this, and therefore wondered if this was an issue others have noticed, and if they were able to see why this was being displayed when it shouldn't be?

 

Thanks in advance :)

18 Replies

Perhaps the account was (temporary) disabled? Best check with your admins.

We have the same behavior:  some users (always the same) are displayed as "xxx has been removed from the team" regularly, then "xxx has been added to the team".

 

Maybe this user is switching from different accounts? It's kinda strange

@Alex_Franklin This happens to me on a daily basis for the past 2 weeks. I will be listed in a specific Team that I have always been in, then suddenly I have been removed.  I am able to rejoin the team since I am part of the organization. It happens multiple times a day at different times each day. This action was not caused by anyone else in my organization, meaning no one on staff is causing this issue. 

This happened to our team today - not seeing any root cause - anyone make any progress or findings on why this is happening?

We have now experienced same kind on behavior and will raise a support ticket for Microsoft. In our case the user account was removed from the team, then the account was disabled and later on enabled. When the account was enabled it seems that the user got added back to the team automatically => audit logs state that the account was added by another user but this another user did not add the user account back in to the team.

@Alex_Franklin 

 

I resolved this issue, by carrying out the following steps

 

Set the channel to Private (was a public channel) , then set back to public again,  set user who was getting removed daily to owner of channel,  Waited for 2 days user didn't get removed, then set user to member,  user hasn't been removed since. 

 

hope this helps

 

Regards

Hi @Irene_Lappalainen225, were you able to find a resolution to this issue?  Thanks!

@Alex_Franklin Thanks for posting this problem.

 

I have been encountering something very similar where a message appears saying that I have removed someone from a Team when I know I have not done so. Seeing your message and the replies now gives me a starting point in how to address this issue. I have a lot of confused colleagues asking why I have removed other colleagues from various teams - when I have not done so. Thanks - Phil.

MS Teams Phantom Edits 3 Blurred.jpg

 

@Phil_W_2001I just started searching for some answers because it looks like I am also unknowingly removing people from teams. I am a global admin and usually the creator of all the teams. My suspicion is that maybe a user left the team on their own and a default message is shown. I will open a ticket with Microsoft to look into it.

Dear @Igor Karon 

Thanks for offering to open a ticket on this issue.

I'm either the sole administrator or a co-administrator on the Teams where this is happening. Good to know that this is an issue - well reassuring to know not an isolated incident. Thanks for letting me know you have similar issues though I am sorry to hear you're suffering from the same problem. If I hear anything useful from our technical people (I work for a university and I have just flagged it up as an issue) I will let you know via this forum.

Regards from, Phil

@Poohkies 

How were you able to set a TEAMS Channel to private and back?

@Phil_W_2001 

In my case it was a user disabled in AD and when removed from a team it used a random owner name for the message. Per Microsoft it is a bug: "Also mentioned in the article above that there is planned work to move this to a system context so it will not show up as a random owner doing it but there is no timeline at this time." Here is the link they send me to:

https://techcommunity.microsoft.com/t5/microsoft-teams/disabled-users-removed-from-teams/m-p/1284519

It is not possible to change channels from private to public. You probably meant changing the Team's privacy.

I had another occurrence of this issue where a user was not disabled in AD. I continued to troubleshoot it with Microsoft and today I received the final verdict:

 

"After investigating internally, confirmed that this is a known issue where Team would display the owner's name for removing the user from the team even though the owner has not removed it.

 

Mainly it has to do with the AAD sync cycle in the background where the sync cycle does not have the actor information, so it displays the random owner name in Teams.

 

Engineers are aware of this issue as multiple tenants have reported it and many ICM's are also being created for the same issue.

 

Engineers have acknowledged the issue and advised that they will be investigating it but at this point time they do not have any ETA for the resolution.

 

Changes made will be made in the future to prevent this behavior from happening again."

Dear @Igor Karon 

 

Thanks for initiating an investigation into this issue. The response you have drawn from Microsoft is most helpful and I will let colleagues know about it. Hope all well with you and thanks again.

 

Regards from, Phil

@Igor Karonthanks for sharing the MS response, very helpful. I've recently noticed this in our organisation too when an owner of a fairly large public Teams raise a security incident as she noticed some members were shown as removed/added while the owner was on leave!  

(In our case, we had a clean-up script that did disable these members in AD due to inactivity.)

 

although, what I find interesting is that both the O365 compliance UnifiedAuditLogs and MCAS (Microsoft Cloud App security) both record this event against the owners name and show as if performed by the owner. This threw us off as a possible security incident until I saw this thread! 

 

(excerpts from UAL below:)

Activity: Removed members

Detail: AuditSearchResultDetail_MemberRemoved
Operation: MemberRemoved
RecordType: 25
Workload: MicrosoftTeams

 

 Microsoft needs to add this issue to the list of known Teams issues here:

https://docs.microsoft.com/en-us/microsoftteams/troubleshoot/teams-welcome 

For us, we synced AD accounts. in the process some accounts needed a little bit of a forceful sync. One of the accounts is our TEAMs keeper and her account now is being randomly removed from Teams even though she is the owner of all teams. all i can do is change the account to a member then remove. then add back as a member and then change to owner. and then add back to each private channel. This sometimes is daily, sometimes is weekly but will happen.