Security loophole in Private Channels?
We came across an interesting use case in our organization today. We have a Team and a private channel within that Teams team. Within the private channel a subsite was created. I am not an owner or member of the Team nor am I a member or owner of the private channel. However during creation of the subsite I was able to be invited with unique permissions to the subsite and I was successfully able to access it. After the initial creation of the subsite, our admin was not able to add or remove or effect any additional permissions on that subsite. Is this a loophole? I expected that without being a member of the private channel I would have absolutely zero access to any items associated with the private channel and site. Which has remained true (when I go to the private channel URL I get denied access) except that I do have access to this specific subsite. My instinct is that the reason permissions cannot be changed after the fact is that this is a genuine loophole and permissions weren't intended by Microsoft to be able to be granted at all on the subsite. This is due to the fact it is under the private channel and permissions should only be able to be changed via the admin UI or from the Teams application. Has anyone come across this in their work? Any guesses or explanations for why the subsite access would be initially available? Is this just genuinely a loophole in the permissions architecture?
List of all private channels that I own
Hi, is there a way for a 'normal business user' without developer access to export a list of all the private channels that whe/she owns? I could identify a list with all the Teams were I was the other but the private channels that belong to those individual teams do not show. How can I export a detail list with all Team and private channels within those Teams? Thanks in advance
Teams Free private channels - add members issue
Hi community, we are experiencing an issue with Teams Free (tenant created a few days ago). We created a Private Channel and we cannot add any members (sometimes after adding, the procedure ends but users is not added). New members (added specifying email address) receive an email confirmation with "Join" button: after clicking URL, Teams will starts but Private Channel is still not displayed. Just tried to create and re-create other Private Channels --> same results. What can we do to solve the problem? Please let us know. Thanks a lot for your cooperation, Stefano China [Tecnostrutture]
