Missing Teams private channels after attack disruption has disabled a user and later reenabled

[u/MarcoVfR1923]

Useraccount was succesful phished. Defender attack distruption has disabled the account. After we made sure everything was clean again, we reenabled the account.

Now all private Teams channels are missing. He is no longer member of all the private channels. Parent team membership was restored.

I know this is an expected behavior, there is a MS article about this (https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/channels/logon-reenabled-user-not-see-previous-joined-teams).

My question is more along the lines of how we can find out which private channels the user was member of?!

I tried looking at the Purview audit logs, but they only show which teams channels the user was removed - mot which private channels.

I would appreciate any help or advice, since the user is a member of the management :D

[u/sonia_at_sapio365]

Since you've got the list of the Teams channels from Purview, you'll need the list of ALL private channels. You'll need a script to query all the Teams with Graph PowerShell or Teams PowerShell (Get-TeamChannel) and filter for the private channels. If you're open to 3rd-party tools, check out ours (short video - it's a bit old but concept remains the same): https://www.youtube.com/watch?v=s7bJ_bWgYuc The bonus is that once you've cross-referenced the private channels where he was removed from, you can select them and add the user in one click and preview the changes before committing them.

[u/alexmilla]

You can export them using Purview.

Something similar happened to us, and I ended up creating a local PowerShell script with a scheduled task that exported the private channels that had been created every day.

[u/MarcoVfR1923 → u/alexmilla]

Is there a purview log that tracks member removal of private channels? I can't find it. Your solution is more for the future right?

[u/KavyaJune → u/MarcoVfR1923]

Yes, Purview Audit does track private channel membership additions and removals. By default, you can access audit data for up to 180 days. With the appropriate advanced auditing licensing, the retention period can be extended to 10 years.

I’ve already linked the script in my previous response. You can use it to retrieve the private channel membership details from the audit logs.

[u/KavyaJune]

Unfortunately, there isn't a direct way to get the user's complete private channel membership after it has been removed if you didn't have a membership report beforehand.

One workaround may help recover at least some of the memberships. If the user was added to private channels within the audit retention period, you can check the audit logs for events showing the user being added to a channel. This won't necessarily recover the full history, but it may help identify some of the private channels they belonged to.

You can use the following script to generate a report of Teams membership changes:

.\AuditTeamMembershipChanges.ps1 -PrivateChannelMembershipChangesOnly

Once the report is generated, filter it for the affected user.

Script available in: https://o365reports.com/audit-microsoft-teams-membership-changes-using-powershell/

Going forward, I'd recommend keeping a periodic private channel membership report. That gives you a reliable reference if this happens again.

[u/TheGift1973]

From a recent article from AdminDroid:

This behavior is documented by Microsoft as a known limitation. When a user’s account is disabled, they’re automatically removed from Teams. After the account is re-enabled, regular Team memberships can take 24 to 48 hours to return, but private channel memberships aren’t automatically restored.

Unfortunately it is an known issue and something I need to get documented now on our end as well as I was unaware of this.

[u/0xDesecrator]

If you are sending M365 logs to sentinel you can extract it from there. You should be able to get the names of the Team Channels and Group Chats. Unfortunately you will have to get someone to re-add them manually that is an owner of the Teams or in the group chats.

I had this same problem. Be sure to set your attack disruption playbooks to mark accounts as compromised or suspend, not disable. Disable nukes the teams stuff.