Bastiaan

<div>
Thank you Vasil. Now you mentioned it, I can remember this vaguely.<br><br>So the best option is to do user management from within teams, instead of the admin portal?
</div>


<div>
Or just look at the Group events.
</div>


<div>
<div class="content wysiwyg-content fr-view">
<p>If we remove users from a Microsoft Team, in the Audit Log a different user who has removed the user is shown. This way we can't be sure who has removed the Teams user. Is this default behaviour, or am I using the 'Users' field wrong?&nbsp;</p><p><br></p><p>Search criteria:<br><a href="https://filedb.experts-exchange.com/incoming/2021/09_w36/1571452/1630670431996.png" rel="ugc"><img src="https://filedb.experts-exchange.com/incoming/2021/09_w36/1571452/1630670431996.png" class="fr-fic fr-dib"></a></p><p><br></p><p>Results:</p><p><br></p><p><a href="https://filedb.experts-exchange.com/incoming/2021/09_w36/1571450/1630670160201.png" rel="ugc"><img src="https://filedb.experts-exchange.com/incoming/2021/09_w36/1571450/1630670160201.png" class="fr-fic fr-dib"></a></p><p><br></p><p>Example given:</p><p>Admin A, removes User A from Teams A. In the audit log of Microsoft, we search for removed members in Teams. In the log, it shows that Amin B has removed User A from Teams A.</p>
</div>
</div>


1630670431996.png

1630670160201.png


If we remove users from a Microsoft Team, in the Audit Log a different user who has removed the user is shown. This way we can't be sure who has removed the Teams user. Is this default behaviour, or am I using the 'Users' field wrong? 
Search criteria:
Results:
Example given:
Admin A, removes User A from Teams A. In the audit log of Microsoft, we search for removed members in Teams. In the log, it shows that Amin B has removed User A from Teams A.

Microsoft Audit Log shows a wrong  user id in log

Microsoft is best known for their Microsoft Windows line of operating systems, the Microsoft Office suite, and the Internet Explorer and Edge web browsers. Microsoft's mission is to "enable people and businesses throughout the world to realize their full potential by creating technology that transforms the way people work, play, and communicate.” Currently, the Windows operating system created by Microsoft powers over a billion devices around the world. On top of their share in the software creation market, Microsoft manufactures hardware, including laptops, phones, and attachments.

Microsoft

Office 365 is a group of software plus services subscriptions that provides productivity software and related services to its subscribers. Office 365 allows the use of Microsoft Office apps on Windows and OS X, provides storage space on Microsoft's cloud storage service OneDrive, and grants 60 Skype minutes per month. Office 365 includes e-mail and social networking services through hosted versions of Exchange Server, Skype for Business Server, SharePoint and Office Online, integration with Yammer, as well as access to the Office software. All of Office 365's components can be managed and configured through an online portal; users can be added manually, imported from a CSV file, or Office 365 can be set up for single sign-on with a local Active Directory using Active Directory Federation Services.