Guest account got deleted and Azure AD audit logs shows actor as "Microsoft B2B Admin Worker"

Question

Couple of guest users were deleted from Azure AD. I checked the audit logs in AAD admin center, the actor is "Microsoft B2B Admin Worker" and type is "Application".
Kindly assist in understating the actor "Microsoft B2B Admin Worker" Can we further check to identify how the guest account were deleted?

Answer 1

Hi @Ajaz Khan · Thank you for reaching out.

This happens when user goes to https://myaccount.microsoft.com/organizations and clicks on leave organization, as shown below:

I tested this out and found below logs gets generated in that case:

The Delete User log is generated with actor "Microsoft B2B Admin Worker" and Delete External user event is generated with actor Username, which is user's own account. You can look for Delete External user events which will provide you with correct actor.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.