question

AjazKhan-3024 avatar image
0 Votes"
AjazKhan-3024 asked AjazKhan-3024 commented

Guest account got deleted and Azure AD audit logs shows actor as "Microsoft B2B Admin Worker"

Couple of guest users were deleted from Azure AD. I checked the audit logs in AAD admin center, the actor is "Microsoft B2B Admin Worker" and type is "Application".
Kindly assist in understating the actor "Microsoft B2B Admin Worker" Can we further check to identify how the guest account were deleted?

azure-active-directory
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

amanpreetsingh-msft avatar image
0 Votes"
amanpreetsingh-msft answered AjazKhan-3024 commented

Hi @AjazKhan-3024 · Thank you for reaching out.

This happens when user goes to https://myaccount.microsoft.com/organizations and clicks on leave organization, as shown below:
119846-image.png

I tested this out and found below logs gets generated in that case:
119777-image.png

The Delete User log is generated with actor "Microsoft B2B Admin Worker" and Delete External user event is generated with actor Username, which is user's own account. You can look for Delete External user events which will provide you with correct actor.


Please "Accept the answer" if the information helped you. This will help us and others in the community as well.


image.png (31.3 KiB)
image.png (18.5 KiB)
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @AjazKhan-3024 · Just checking if you have any further question.

1 Vote 1 ·

Hi Amandeep, Thanks for your assistance.

0 Votes 0 ·