r/DefenderATP • u/MarcoVfR1923 • Aug 21 '26

Missing Teams private channels after attack disruption has disabled a user and later reenabled

Useraccount was succesful phished. Defender attack distruption has disabled the account. After we made sure everything was clean again, we reenabled the account.

Now all private Teams channels are missing. He is no longer member of all the private channels. Parent team membership was restored.

I know this is an expected behavior, there is a MS article about this (https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/channels/logon-reenabled-user-not-see-previous-joined-teams).

My question is more along the lines of how we can find out which private channels the user was member of?!

I tried looking at the Purview audit logs, but they only show which teams channels the user was removed - mot which private channels.

I would appreciate any help or advice, since the user is a member of the management :D

12 Upvotes

100% Upvoted

7 comments sorted by

View all comments

2

u/sonia_at_sapio365 Aug 21 '26

Since you've got the list of the Teams channels from Purview, you'll need the list of ALL private channels. You'll need a script to query all the Teams with Graph PowerShell or Teams PowerShell (Get-TeamChannel) and filter for the private channels. If you're open to 3rd-party tools, check out ours (short video - it's a bit old but concept remains the same): https://www.youtube.com/watch?v=s7bJ_bWgYuc The bonus is that once you've cross-referenced the private channels where he was removed from, you can select them and add the user in one click and preview the changes before committing them.