How to retrieve a log of all users (e-mail addresses) that ever had access to a specific Sharepoint/Teams Channel?

Question

Dear all,

I am the Administrator of my company account with Microsoft incl. 365 subscription.

We have previously created a Sharepoint where we have invited external users to access and edit files. We have in the meantime removed them from accessing this Sharepoint - however, we would now need an audit log that shows which users (e-Mail Adresses) ever had access to that Sharepoint/Teams Channel. Currently, removed users show up as "Unknown User" and do not show in the new activity logs. Unfortunately it seems that previous answers on this topic do not apply to the new audit log features of Microsoft anymore.

Thank you very much in advance!

KR

Answer 1

Per my test, if a guest user has been deleted, his activities also show in the audit logs.

1.Delete a user.

2.In the audit logs.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Get-SPOUser -Site https://contoso.sharepoint.com/sites/finance

https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/get-spouser?view=sharepoint-ps

You will get all user that ever accessed that site, no matter if they have been deleted, internal or external.
Each site has its own user list where every user that access the site is registered and stays there until manually deleted from that list. Removing used from Entra ID doesn't remove it from each site.