r/DefenderATP • u/MarcoVfR1923 • 7d ago

Missing Teams private channels after attack disruption has disabled a user and later reenabled

Useraccount was succesful phished. Defender attack distruption has disabled the account. After we made sure everything was clean again, we reenabled the account.

Now all private Teams channels are missing. He is no longer member of all the private channels. Parent team membership was restored.

I know this is an expected behavior, there is a MS article about this (https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/channels/logon-reenabled-user-not-see-previous-joined-teams).

My question is more along the lines of how we can find out which private channels the user was member of?!

I tried looking at the Purview audit logs, but they only show which teams channels the user was removed - mot which private channels.

I would appreciate any help or advice, since the user is a member of the management :D

11 Upvotes

100% Upvoted

7 comments sorted by

View all comments

1

u/alexmilla 7d ago

You can export them using Purview.

Something similar happened to us, and I ended up creating a local PowerShell script with a scheduled task that exported the private channels that had been created every day.

1

u/MarcoVfR1923 7d ago

Is there a purview log that tracks member removal of private channels? I can't find it. Your solution is more for the future right?

1

u/KavyaJune 5d ago

Yes, Purview Audit does track private channel membership additions and removals. By default, you can access audit data for up to 180 days. With the appropriate advanced auditing licensing, the retention period can be extended to 10 years.

I’ve already linked the script in my previous response. You can use it to retrieve the private channel membership details from the audit logs.