Aug 29 2019 05:24 AM
Hi there. A customer of mine has reported that a Team their staff used this morning presented a message in the feed saying "{User} has been removed from the Team." The user in question definitely has not been, they've just gone on holiday. I've seen a couple of other cases there where this message has shown in the feed when we're sure it shouldn't. Unfortunately, as the person is on holiday I can't ask them to confirm that they have access, but my customer is certain nobody removed them.
I've been unable to find anything that could explain this, and therefore wondered if this was an issue others have noticed, and if they were able to see why this was being displayed when it shouldn't be?
Thanks in advance :)
Aug 29 2019 08:17 AM
Perhaps the account was (temporary) disabled? Best check with your admins.
Sep 05 2019 01:42 AM
We have the same behavior: some users (always the same) are displayed as "xxx has been removed from the team" regularly, then "xxx has been added to the team".
Maybe this user is switching from different accounts? It's kinda strange
Sep 18 2019 04:15 PM
@Alex_Franklin This happens to me on a daily basis for the past 2 weeks. I will be listed in a specific Team that I have always been in, then suddenly I have been removed. I am able to rejoin the team since I am part of the organization. It happens multiple times a day at different times each day. This action was not caused by anyone else in my organization, meaning no one on staff is causing this issue.
Oct 15 2019 12:10 PM
This happened to our team today - not seeing any root cause - anyone make any progress or findings on why this is happening?
Nov 13 2019 01:22 AM
We have now experienced same kind on behavior and will raise a support ticket for Microsoft. In our case the user account was removed from the team, then the account was disabled and later on enabled. When the account was enabled it seems that the user got added back to the team automatically => audit logs state that the account was added by another user but this another user did not add the user account back in to the team.
Mar 02 2020 04:49 PM - edited Mar 02 2020 04:50 PM
I resolved this issue, by carrying out the following steps
Set the channel to Private (was a public channel) , then set back to public again, set user who was getting removed daily to owner of channel, Waited for 2 days user didn't get removed, then set user to member, user hasn't been removed since.
hope this helps
Regards
Apr 08 2020 01:17 PM
Hi @Irene_Lappalainen225, were you able to find a resolution to this issue? Thanks!
Apr 26 2020 03:36 AM
@Alex_Franklin Thanks for posting this problem.
I have been encountering something very similar where a message appears saying that I have removed someone from a Team when I know I have not done so. Seeing your message and the replies now gives me a starting point in how to address this issue. I have a lot of confused colleagues asking why I have removed other colleagues from various teams - when I have not done so. Thanks - Phil.
Apr 26 2020 01:06 PM
@Phil_W_2001I just started searching for some answers because it looks like I am also unknowingly removing people from teams. I am a global admin and usually the creator of all the teams. My suspicion is that maybe a user left the team on their own and a default message is shown. I will open a ticket with Microsoft to look into it.
Apr 26 2020 01:14 PM
Dear @Igor Karon
Thanks for offering to open a ticket on this issue.
I'm either the sole administrator or a co-administrator on the Teams where this is happening. Good to know that this is an issue - well reassuring to know not an isolated incident. Thanks for letting me know you have similar issues though I am sorry to hear you're suffering from the same problem. If I hear anything useful from our technical people (I work for a university and I have just flagged it up as an issue) I will let you know via this forum.
Regards from, Phil
Apr 27 2020 11:53 AM
How were you able to set a TEAMS Channel to private and back?
Apr 28 2020 12:35 PM
In my case it was a user disabled in AD and when removed from a team it used a random owner name for the message. Per Microsoft it is a bug: "Also mentioned in the article above that there is planned work to move this to a system context so it will not show up as a random owner doing it but there is no timeline at this time." Here is the link they send me to:
https://techcommunity.microsoft.com/t5/microsoft-teams/disabled-users-removed-from-teams/m-p/1284519
Apr 28 2020 12:36 PM
Apr 28 2020 10:38 PM
@Igor Karon
Thanks!!
May 04 2020 10:45 AM
I had another occurrence of this issue where a user was not disabled in AD. I continued to troubleshoot it with Microsoft and today I received the final verdict:
"After investigating internally, confirmed that this is a known issue where Team would display the owner's name for removing the user from the team even though the owner has not removed it.
Mainly it has to do with the AAD sync cycle in the background where the sync cycle does not have the actor information, so it displays the random owner name in Teams.
Engineers are aware of this issue as multiple tenants have reported it and many ICM's are also being created for the same issue.
Engineers have acknowledged the issue and advised that they will be investigating it but at this point time they do not have any ETA for the resolution.
Changes made will be made in the future to prevent this behavior from happening again."
May 04 2020 12:26 PM
Dear @Igor Karon
Thanks for initiating an investigation into this issue. The response you have drawn from Microsoft is most helpful and I will let colleagues know about it. Hope all well with you and thanks again.
Regards from, Phil
Oct 26 2020 09:11 AM
@Igor Karonthanks for sharing the MS response, very helpful. I've recently noticed this in our organisation too when an owner of a fairly large public Teams raise a security incident as she noticed some members were shown as removed/added while the owner was on leave!
(In our case, we had a clean-up script that did disable these members in AD due to inactivity.)
although, what I find interesting is that both the O365 compliance UnifiedAuditLogs and MCAS (Microsoft Cloud App security) both record this event against the owners name and show as if performed by the owner. This threw us off as a possible security incident until I saw this thread!
(excerpts from UAL below:)
Detail: AuditSearchResultDetail_MemberRemoved
Operation: MemberRemoved
RecordType: 25
Workload: MicrosoftTeams
Microsoft needs to add this issue to the list of known Teams issues here:
https://docs.microsoft.com/en-us/microsoftteams/troubleshoot/teams-welcome
Apr 08 2022 05:58 AM