Share via

Audit Logs Teams

Glenn Maxwell 12,876 Reputation points
2022-01-12T02:23:14.357+00:00

Hi All

One of the teams channel was deleted. from the audit logs i could see one of the user lets say tom has deleted the teams channel. The user tom who has deleted the teams channel is neither the member of the unified group nor he is the owner of the unified group. How can this be possible experts guide me on this.

Exchange Online
Exchange Online
A Microsoft email and calendaring hosted service.
6,186 questions
Microsoft Teams | Microsoft Teams for business | Other
0 comments
Accepted answer
  1. Yuki Sun-MSFT 41,376 Reputation points Moderator
    2022-01-12T06:39:01.247+00:00

    Hi @Glenn Maxwell ,

    Agree with michev the user may have been a member or owner before the channel was deleted.

    Moreover, another possiblity you can check is to see whether he has any admin role which enable him to delete the channel from the Admin Center. For example, I login in the Teams Admin Center using the account of a global administrator, and can delete a channel from a team that I am not a member or owner of:
    164233-01.png

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vasil Michev 119.7K Reputation points MVP Volunteer Moderator
    2022-01-12T06:10:18.03+00:00

    Perhaps we was a member/owner at the time of deletion, but left (was removed from) the team later? Do check any membership change events for the team in the same timeframe. Also, keep in mind that some Teams audit events are attributes to a "random" owner as detailed here: https://learn.microsoft.com/en-us/microsoftteams/audit-log-events#attribution-in-teams-audit-logs

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.