Microsoft Teams – You have done it! And I know you have …

Earlier this week I noticed a message in the Message center about Auditing in Microsoft Teams being rolled out.

The following events should now all appear within your audit log:

  • Added Bot to Team
  • Removed Bot from Team
  • Added Tab
  • Removed Tab
  • Added Connector
  • Removed Connector
  • Added Channel
  • Deleted Channel

So I visited https://protection.office.com to make sure that audit logging had been enabled.

Microsoft Teams - You have done it! And I know you have ... Microsoft Office 365, Microsoft Teams startrecording

then I went to https://protection.office.com to search my audit logs for Miocrosoft teams event:

Microsoft Teams - You have done it! And I know you have ... Microsoft Office 365, Microsoft Teams teamsactivities

So there are actually a lot more events:

  • Create team
  • Delete Team
  • Change Organisation Setting
  • Change Team Setting
  • Change Channel Setting
  • Change Setting(legacy)
  • User signed in to teams
  • Added Bot to Team
  • Removed Bot from Team
  • Added Tab
  • Removed Tab
  • Added Connector
  • Removed Connector
  • Added Channel
  • Deleted Channel

So I selected all teams events in my Audit log. Note that it can take a while for Auditing to be logged and be searchable. So don’t expect some results straight away.

Microsoft Teams - You have done it! And I know you have ... Microsoft Office 365, Microsoft Teams waitawhile

In the meanwhile I will have a look at all those events that are available.

Some missing events in the above list are:

  • added external user to team
  • removed external user to team
  • external user logged in

When looking at auditing I would like to see some events related to my external users included.

How about guests?

Table of Contents

First I enabled  both guest permissions available. So that my guest account can add and remove some channels.

Microsoft Teams - You have done it! And I know you have ... Microsoft Office 365, Microsoft Teams guestaccessteams

and then I added a channel as the external user:

Microsoft Teams - You have done it! And I know you have ... Microsoft Office 365, Microsoft Teams

Then after a while (up to 24 hours) when my auditing started working I got the results back.

 

Microsoft Teams - You have done it! And I know you have ... Microsoft Office 365, Microsoft Teams audit log

 

 

Time to look at this in a bit more details. I can now see that I logged in with my guest account:

Microsoft Teams - You have done it! And I know you have ... Microsoft Office 365, Microsoft Teams loggedin

 

And the more information drop down  gives the following information.

 

Microsoft Teams - You have done it! And I know you have ... Microsoft Office 365, Microsoft Teams more info

So it is possible to recognize the guest users by their email address.

 

Going through the log though:

Microsoft Teams - You have done it! And I know you have ... Microsoft Office 365, Microsoft Teams signin

Issues

Did I really sign in every 56 minutes last night? I don’t think so. It looks like the background process running on your windows PC does the login for your every 56 minutes.

 

An additional issue that I found is that  internal user’s IP address is recorded in the logs, however for guest users this doesn’t happen.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 4,911 other subscribers

Recent Posts

Archive

Thank you for visiting SharePains

%d bloggers like this: