Audit Logs Teams

Question

Hi All

One of the teams channel was deleted. from the audit logs i could see one of the user lets say tom has deleted the teams channel. The user tom who has deleted the teams channel is neither the member of the unified group nor he is the owner of the unified group. How can this be possible experts guide me on this.

Answer 1

Hi @Glenn Maxwell ,

Agree with michev the user may have been a member or owner before the channel was deleted.

Moreover, another possiblity you can check is to see whether he has any admin role which enable him to delete the channel from the Admin Center. For example, I login in the Teams Admin Center using the account of a global administrator, and can delete a channel from a team that I am not a member or owner of:

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Perhaps we was a member/owner at the time of deletion, but left (was removed from) the team later? Do check any membership change events for the team in the same timeframe. Also, keep in mind that some Teams audit events are attributes to a "random" owner as detailed here: https://learn.microsoft.com/en-us/microsoftteams/audit-log-events#attribution-in-teams-audit-logs