Microsoft Teams activity

Operation	Description	Sample	Rule
any	Catch-all for M365-MicrosoftTeams rules matching the RecordType but no specific Operation.	N	N
ChannelAdded	Channel Added activity in Microsoft Teams, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
MemberAdded	A user was added as a member of a Microsoft Teams team or channel.	N	Y
MemberRemoved	A user was removed from a Microsoft Teams team or channel.	Y	Y
MessageSent	Message Sent activity in Microsoft Teams, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
TabAdded	Tab Added activity in Microsoft Teams, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
TeamCreated	Team Created activity in Microsoft Teams, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
TeamDeleted	A Microsoft Teams team was deleted.	Y	Y
TeamsSessionStarted	Teams Session Started activity in Microsoft Teams, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
TeamsTenantSettingChanged	A tenant-level Microsoft Teams configuration setting was changed by an administrator.	N	Y
ChatCreated	A Microsoft Teams chat was created, as documented in the Microsoft Purview audit activity reference.	N	Y

any: Microsoft Teams activity (catch-all)

RecordType: MicrosoftTeams

Description

Catch-all for M365-MicrosoftTeams rules matching the RecordType but no specific Operation.

ChannelAdded

RecordType: MicrosoftTeams

Description

Channel Added activity in Microsoft Teams, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "AADGroupId": "ca5d50d9-83af-43d6-8a3a-4f3c00590bec",
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "IssuedAtTime": "2026-07-02T02:05:02Z",
    "UniqueTokenId": "EZ1kQWhHXUamXGzX4vdFAA"
  },
  "ChannelGuid": "19:00000000000000000000000000000002@thread.tacv2",
  "ChannelName": "dw-harness-60974bd7-channel",
  "ChannelType": "Standard",
  "CreationTime": "2026-07-02T02:10:25Z",
  "Id": "ba48d616-6851-4c6e-9559-cbc9f8ac1266",
  "Operation": "ChannelAdded",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "RecordType": 25,
  "TeamGuid": "19:1woqJPMNE2DLPz-FlUMx_ppjKalYh1NsryTVKFYlnas1@thread.tacv2",
  "TeamName": "dw-harness-60974bd7",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "11111111-1111-1111-1111-111111111111",
  "UserType": 2,
  "Version": 1,
  "Workload": "MicrosoftTeams"
}

MemberAdded

RecordType: MicrosoftTeams

Description

A user was added as a member of a Microsoft Teams team or channel.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	2 detection rules	Kusto
`CommunicationType`	1 detection rule	Kusto
`Members`	1 detection rule	Kusto
`Workload`	1 detection rule	Kusto

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`TimeDeleted` (kusto rule field)	cross_field_compare	`TimeAdded`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Anomalous login followed by Teams action source medium: Detects anomalous IP address usage by user accounts and then checks to see if a suspicious Teams action is performed. Query calculates IP usage Delta for each user account and selects accounts where a delta >= 90% is observed between the most and least used IP. To further reduce results the query performs a prevalence check on the lowest used IP's country, only keeping IP's where the country is unusual for the tenant (dynamic ranges). Please note, if the initial logic of prevalence to find suspicious logon activity is noisy then consider adding filtering based on Location. Finally the user accounts activity within Teams logs is checked for suspicious commands (modifying user privileges or admin actions) during the period the suspicious IP was active.T1078, T1098, T1136, T1199↳ also matches MemberRemoved
External user added and removed in short timeframe source low: This detection flags the occurrences of external user accounts that are added to a Team and then removed within one hour.T1136↳ also matches MemberRemoved

MemberRemoved

RecordType: MicrosoftTeams

Description

A user was removed from a Microsoft Teams team or channel.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	2 detection rules	Kusto
`CommunicationType`	1 detection rule	Kusto
`Members`	1 detection rule	Kusto
`metadata.log_type`	1 detection rule	YARA-L
`security_result.action`	1 detection rule	YARA-L
`target.application`	1 detection rule	YARA-L
`TimeDeleted`	1 detection rule	Kusto
`UPN`	1 detection rule	Kusto
`Workload`	1 detection rule	Kusto

Example Audit Record #

{
  "AADGroupId": "0d5495a4-0e78-4a46-8f73-919ad36fb319",
  "CommunicationType": "Team",
  "CreationTime": "2026-07-02T07:53:08Z",
  "Id": "4b34fcf7-9264-5e05-8427-7ca6c49d087d",
  "IsBilateral": false,
  "ItemName": "NCT",
  "Members": [
    {
      "OrganizationId": "00000000-0000-0000-0000-000000000001",
      "Role": 1,
      "UPN": "47b593cb-31b1-4f8a-bc28-89d4f17acea3"
    },
    {
      "OrganizationId": "00000000-0000-0000-0000-000000000001",
      "Role": 1,
      "UPN": "490cfe27-1e24-48d8-a3ee-bdacf3c3ee4b"
    }
  ],
  "Operation": "MemberRemoved",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "ParticipantInfo": {
    "HasForeignTenantUsers": false,
    "HasGuestUsers": false,
    "HasUnauthenticatedUsers": false
  },
  "RecordType": 25,
  "ResourceTenantId": "00000000-0000-0000-0000-000000000001",
  "TeamGuid": "19:5kFR8dAxYxQpPHKVnxRwB5v6WEC0cIQTN3w7xSs7UvQ1@thread.tacv2",
  "TeamName": "NCT",
  "UserId": "Microsoft Teams - Teams And Channels Service",
  "UserKey": "b55b276d-2b09-4ad2-8de5-f09cf24ffba9",
  "UserMRI": "28:app:00000000-0000-0000-0000-000000000001_b55b276d-2b09-4ad2-8de5-f09cf24ffba9",
  "UserType": 5,
  "Version": 1,
  "Workload": "MicrosoftTeams"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`TimeDeleted` (kusto rule field)	cross_field_compare	`TimeAdded`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Anomalous login followed by Teams action source medium: Detects anomalous IP address usage by user accounts and then checks to see if a suspicious Teams action is performed. Query calculates IP usage Delta for each user account and selects accounts where a delta >= 90% is observed between the most and least used IP. To further reduce results the query performs a prevalence check on the lowest used IP's country, only keeping IP's where the country is unusual for the tenant (dynamic ranges). Please note, if the initial logic of prevalence to find suspicious logon activity is noisy then consider adding filtering based on Location. Finally the user accounts activity within Teams logs is checked for suspicious commands (modifying user privileges or admin actions) during the period the suspicious IP was active.T1078, T1098, T1136, T1199↳ also matches MemberAdded
External user added and removed in short timeframe source low: This detection flags the occurrences of external user accounts that are added to a Team and then removed within one hour.T1136↳ also matches MemberAdded

YARA-L #

Office 365 Teams member removed source low: Detects when a user is removed from a group in Microsoft Teams.

MessageSent

RecordType: MicrosoftTeams

Description

Message Sent activity in Microsoft Teams, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "AADGroupId": "ca5d50d9-83af-43d6-8a3a-4f3c00590bec",
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "APIId": "00000003-0000-0000-c000-000000000000",
    "ClientAppId": "22222222-2222-2222-2222-222222222222",
    "ClientAppName": "dw-activity-gen",
    "CorrelationId": "0b743928-a057-446f-a96c-7b6905ef2d48",
    "IssuedAtTime": "2026-07-02T02:04:44Z",
    "UniqueTokenId": "fok73fVNMECa2s8q2X5cAA"
  },
  "ChannelGuid": "19:00000000000000000000000000000002@thread.tacv2",
  "CommunicationType": "Channel",
  "CreationTime": "2026-07-02T02:10:25Z",
  "Id": "866d4914-1e09-4edd-8992-e48c41710ec7",
  "ItemName": "19:00000000000000000000000000000002@thread.tacv2",
  "MessageId": "1782958225737",
  "MessageSizeInBytes": 84,
  "MessageVersion": "1782958225737",
  "Operation": "MessageSent",
  "OperationScope": 1,
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "RecordType": 25,
  "TeamName": "dw-harness-60974bd7",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "11111111-1111-1111-1111-111111111111",
  "UserType": 2,
  "Version": 1,
  "Workload": "MicrosoftTeams"
}

TabAdded

RecordType: MicrosoftTeams

Description

Tab Added activity in Microsoft Teams, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "AADGroupId": "ca5d50d9-83af-43d6-8a3a-4f3c00590bec",
  "AddOnGuid": "tab::b682ca35-f699-41f7-a888-eff88431e33b",
  "AddOnName": "Notes",
  "AddOnType": 3,
  "AddOnUrl": "https://www.onenote.com/teams/ChannelNotes?ui={locale}&tenantId={tid}&upn={upn}&groupId={groupId}&theme={theme}&entityId={entityId}&subEntityId={subEntityId}&sessionId={sessionId}&ringId={ringId}&teamSiteUrl={teamSiteUrl}&channelType={channelType}&trackingId={appSessionId}&hostClientType={hostClientType}&channelName={channelName}&teamType={teamType}",
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "IssuedAtTime": "2026-07-02T02:05:20Z",
    "UniqueTokenId": "p5CWC8fQp0WBTwURdPVFAA"
  },
  "ChannelGuid": "19:1woqJPMNE2DLPz-FlUMx_ppjKalYh1NsryTVKFYlnas1@thread.tacv2",
  "ChannelName": "General",
  "ChannelType": "Standard",
  "ClientIP": "::ffff:203.0.113.10",
  "CommunicationType": "Channel",
  "CreationTime": "2026-07-02T02:10:22Z",
  "Id": "c7b3dd75-4bba-5e5a-9f90-20e6e6655f79",
  "IsBilateral": false,
  "Operation": "TabAdded",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "RecordType": 25,
  "ResourceTenantId": "00000000-0000-0000-0000-000000000001",
  "TabType": "extension",
  "TeamGuid": "19:1woqJPMNE2DLPz-FlUMx_ppjKalYh1NsryTVKFYlnas1@thread.tacv2",
  "TeamName": "dw-harness-60974bd7",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "11111111-1111-1111-1111-111111111111",
  "UserMRI": "8:orgid:11111111-1111-1111-1111-111111111111",
  "UserType": 0,
  "Version": 1,
  "Workload": "MicrosoftTeams"
}

TeamCreated

RecordType: MicrosoftTeams

Description

Team Created activity in Microsoft Teams, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "IssuedAtTime": "2026-07-02T02:05:03Z",
    "UniqueTokenId": "eNxdqQmucEeZOeKcEzBMAA"
  },
  "CreationTime": "2026-07-02T02:10:10Z",
  "Id": "2f9711aa-f826-4773-9626-a7f0b34875e4",
  "Operation": "TeamCreated",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "RecordType": 25,
  "TeamGuid": "19:1woqJPMNE2DLPz-FlUMx_ppjKalYh1NsryTVKFYlnas1@thread.tacv2",
  "TeamName": "dw-harness-60974bd7",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "11111111-1111-1111-1111-111111111111",
  "UserType": 0,
  "Version": 1,
  "Workload": "MicrosoftTeams"
}

TeamDeleted

RecordType: MicrosoftTeams

Description

A Microsoft Teams team was deleted.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	1 detection rule	Kusto
`Workload`	1 detection rule	Kusto

Example Audit Record #

{
  "AADGroupId": "ca5d50d9-83af-43d6-8a3a-4f3c00590bec",
  "AppAccessContext": {
    "AADSessionId": "006b25ca-502b-b64c-eece-a415f825b7c1",
    "IssuedAtTime": "2026-07-02T02:05:21Z",
    "UniqueTokenId": "6AyzXCNIZEiEWoobVo4oAA"
  },
  "CreationTime": "2026-07-02T02:10:36Z",
  "Id": "78fc3aac-2f4a-4356-905f-e2b76b5f5f0c",
  "Operation": "TeamDeleted",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "RecordType": 25,
  "TeamGuid": "19:1woqJPMNE2DLPz-FlUMx_ppjKalYh1NsryTVKFYlnas1@thread.tacv2",
  "TeamName": "dw-harness-60974bd7",
  "UserId": "Microsoft Teams Sync",
  "UserKey": "62b732f7-fc71-40bc-b27d-35efcb0509de",
  "UserType": 5,
  "Version": 1,
  "Workload": "MicrosoftTeams"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Multiple Teams deleted by a single user source low: This detection flags the occurrences of deleting multiple teams within an hour. This data is a part of Office 365 Connector in Microsoft Sentinel.T1485, T1489

TeamsSessionStarted

RecordType: MicrosoftTeams

Description

Teams Session Started activity in Microsoft Teams, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "IssuedAtTime": "2026-07-03T01:52:12",
    "UniqueTokenId": "TGQMyWP-eEaoKSIUKgABAA"
  },
  "CreationDate": "2026-07-03T01:57:13",
  "CreationTime": "2026-07-03T01:57:13",
  "Id": "9af2c3e9-aac5-4f27-b92c-69a5673f3b9b",
  "ObjectId": "TeamsGraphService (Unknown)",
  "Operation": "TeamsSessionStarted",
  "Operations": "TeamsSessionStarted",
  "OrganizationId": "11111111-1111-1111-1111-111111111111",
  "RecordType": "MicrosoftTeams",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserType": "Regular",
  "Version": 1,
  "Workload": "MicrosoftTeams"
}

TeamsTenantSettingChanged

RecordType: MicrosoftTeams

Description

A tenant-level Microsoft Teams configuration setting was changed by an administrator.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.action`	1 detection rule	Elastic
`event.category`	1 detection rule	Elastic
`event.outcome`	1 detection rule	Elastic
`event.provider`	1 detection rule	Elastic
`o365.audit.Name`	1 detection rule	Elastic
`o365.audit.NewValue`	1 detection rule	Elastic

Common Indicators #

Field	Kind	Value	Rules	Vendors
`event.outcome` (elastic rule field)	eq	`success`	1 rule	elastic
`o365.audit.Name` (elastic rule field)	eq	`allow sideloading and interaction of custom apps`	1 rule	elastic
`o365.audit.NewValue` (elastic rule field)	eq	`true`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

M365 Teams Custom Application Interaction Enabled source medium: Identifies when custom applications are allowed in Microsoft Teams. If an organization requires applications other than those available in the Teams app store, custom applications can be developed as packages and uploaded. An adversary may abuse this behavior to establish persistence in an environment.T1484, T1562

ChatCreated

RecordType: MicrosoftTeams

Description

A Microsoft Teams chat was created, as documented in the Microsoft Purview audit activity reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.action`	1 detection rule	Elastic
`event.outcome`	1 detection rule	Elastic
`event.provider`	1 detection rule	Elastic
`o365.audit.CommunicationType`	1 detection rule	Elastic
`o365.audit.Members`	1 detection rule	Elastic
`o365.audit.ParticipantInfo.HasForeignTenantUsers`	1 detection rule	Elastic
`o365.audit.ParticipantInfo.HasGuestUsers`	1 detection rule	Elastic
`o365.audit.ParticipantInfo.HasOtherGuestUsers`	1 detection rule	Elastic
`user.email`	1 detection rule	Elastic
`UserId`	1 detection rule	Elastic

Common Indicators #

Field	Kind	Value	Rules	Vendors
`event.outcome` (elastic rule field)	eq	`success`	1 rule	elastic
`o365.audit.CommunicationType` (elastic rule field)	eq	`oneonone`	1 rule	elastic
`o365.audit.Members` (elastic rule field)	in	`help desk`	1 rule	elastic
`o365.audit.Members` (elastic rule field)	in	`help desk it`	1 rule	elastic
`o365.audit.Members` (elastic rule field)	in	`help desk team`	1 rule	elastic
`o365.audit.Members` (elastic rule field)	in	`it help desk`	1 rule	elastic
`o365.audit.Members` (elastic rule field)	in	`microsoft security`	1 rule	elastic
`o365.audit.Members` (elastic rule field)	in	`microsoft security`	1 rule	elastic
`o365.audit.Members` (elastic rule field)	in	`microsoft support`	1 rule	elastic
`o365.audit.ParticipantInfo.HasForeignTenantUsers` (elastic rule field)	eq	`true`	1 rule	elastic
`o365.audit.ParticipantInfo.HasGuestUsers` (elastic rule field)	eq	`false`	1 rule	elastic
`o365.audit.ParticipantInfo.HasOtherGuestUsers` (elastic rule field)	eq	`false`	1 rule	elastic
`user` (elastic rule field)	contains	`help-desk`	1 rule	elastic
`user` (elastic rule field)	contains	`helpdesk`	1 rule	elastic
`user` (elastic rule field)	contains	`ithelp`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

M365 Teams Rogue Help Desk Chat Created source high: Identifies a one-on-one Microsoft Teams chat created by a user from a foreign tenant whose display name, member profile, or email local-part resembles IT help desk or Microsoft security staff. Adversaries abuse cross-tenant Teams external access to impersonate support personnel and socially engineer victims into granting remote access or disclosing credentials.T1566, T1566.003

References #

M365 audit records use different field names on each surface #

The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.

Purview CSV export flattens each record to four columns (CreationDate, UserIds, Operations, AuditData). The API field names live only inside the AuditData JSON blob. Expand it with ConvertFrom-Json. The wrapper columns are renamed too: CreationDate not CreationTime, UserIds not UserId, Operations not Operation.
Sentinel's OfficeActivity table renames several fields and turns two integer enum columns into strings. The table below maps them.

API JSON (event pages)	OfficeActivity column	Note
`Id`	`OfficeId`	Renamed.
`Workload`	`OfficeWorkload`	Renamed.
`ObjectId`	`OfficeObjectId`	Renamed.
`CreationTime`	`TimeGenerated`	Renamed. OfficeActivity has no `CreationTime` column.
`SiteUrl`	`Site_Url`	Renamed (SharePoint family).
`RecordType`	`RecordType`	Same name; the Int32 enum becomes its string enum name.
`UserType`	`UserType`	Same name; the Int32 enum becomes a string.
`ClientIP`	`ClientIP`, `Client_IPAddress`	Both columns present on OfficeActivity.
`Scope`	(none)	No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview `AuditData` blob.
`Operation`, `UserId`, `ResultStatus`, `UserKey`, `AppAccessContext`, `OrganizationId`	same names	Unchanged. No `_s` / `_d` suffixes (a native table, not a custom log).

Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.

Microsoft Teams activity

any: Microsoft Teams activity (catch-all)

Description

ChannelAdded

Description

Example Audit Record #

MemberAdded

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Kusto #

MemberRemoved

Description

Detection Fields #

Example Audit Record #

Common Indicators #

Related events #

Detection Rules #

Kusto #

YARA-L #

MessageSent

Description

Example Audit Record #

TabAdded

Description

Example Audit Record #

TeamCreated

Description

Example Audit Record #

TeamDeleted

Description

Detection Fields #

Example Audit Record #

Detection Rules #

Kusto #

TeamsSessionStarted

Description

Example Audit Record #

TeamsTenantSettingChanged

Description

Detection Fields #

Common Indicators #

Detection Rules #

Elastic #

ChatCreated

Description

Detection Fields #

Common Indicators #

Detection Rules #

Elastic #

References #