Audit Records: Analyzing Team Reactions & Responses

Blog Post Summary: Reactions on Teams and Their Impact

Let's take a closer look at a blog post by Tony Redmond [MVP] which emphasizes on the inclusion of Teams reactions in Purview Premium eDiscovery. This feature was announced generally available on 5th July 2022 as per message center notification MC397444. The reactions which Teams supports include thumbs-up, surprise, sad, angry, heart, and laugh, serving as an indication of users' thoughts on any given message in a chat or a channel conversation.

This inclusion is important as reactions can provide crucial context for a conversation. Microsoft made it clear in MC397444 that this detail can present additional insights into user sentiment. As of July 2022, approximately 12% of Office 365 paid seats with E5 level access could use Purview Premium eDiscovery whilst the remaining seats had no such access or were only offered the standard eDiscovery included in Office 365 E3.

The standard eDiscovery searches through the Teams compliance records held by the Microsoft 365 substrate and stored in user mailboxes in Exchange Online. On the contrary, Teams compliance records do not include reactions since this data is absent in the compliance records despite being captured in chats and channel conversations edits.

Fast forward to late August 2022, it was noted that Teams also began to support records capturing for message reactions in the unified audit log. It’s suggested that system administrators scan this audit log periodically to identify any new events recorded.

The ReactedToMessage event, for example, was found to report reactions for both chats and channel conversations. The content of the AuditData property in these events however varied with whether it was reporting a chat or a channel conversation.

Resolving a given details like team's GUID to its respective display name and identifying which channel that reaction belongs to requires a bit of work. However, using commands like Get-MgTeamChannel can help obtain the required display names and make the output much presentable.

It was also found that Teams does not record an audit event with a different operation code when a reaction to a message is removed. In case a user changes their initial reaction by removing it and adding a new one, two respective audit events will be captured for that individual message.

Finding the message to which a reaction belongs is quite easy with the help of the message identifier. Using the Graph chatMessage API could help retrieve a message and all its replies, checks which messages in the thread have reactions, and prints details of the message, its author, date posted, the text and the reaction.

If your account is a part of the team, you can use the weburl returned for the message to directly open Teams and view the message.

This exercise heavy insinuated that the audit records captured for Teams reactions can be cross-purposed. The audit data could be used in combination with the traditional eDiscovery, to find out if reactions exist for any troubling messages. Hence proving to be a beneficial place to seek data from.

General Thoughts

In general, the inclusion of reactions in any communication tool adds a layer of expressiveness. Apart from serving as non-verbal cues, in certain cases like in Microsoft Teams, they provide additional context to conversations when examined from a compliance point of view. While significantly important in deciphering the users' sentiment, these features set new benchmarks in enhancing collaboration and productivity in any workspace. This underlines the importance of staying updated with the latest features and understanding how to browse through the data points behind the curtain.

Read the full article Teams Reactions Captured in Audit Records

Learn about Teams Reactions Captured in Audit Records

In today's digital era, collaborative tools like Microsoft Teams have become essential for businesses. Microsoft Teams allows users to respond to messages through various reactions. This aspect of Teams has now been updated to be included in the Purview Premium eDiscovery. Initially announced in July 2022, the feature, known as 'Teams reactions', enhances the context of a conversation by providing additional user sentiment, as Microsoft says.

Teams enables users to react to messages using different icons, representing emotions like surprise, anger, sadness, and laughter. This helps the sender understand the receiver's perspective towards the message. Such reactions are meaningful in investigations where both the message and reactions are crucial to drive insights into a conversation. For instance, a user showing agreement to a fraudulent transaction suggestion through a thumbs-up reaction provides valuable context to an investigation.

Microsoft reported that approximately 12% of Office 365 subscribers who availed paid seats used E5 and hence, hold access to Purview Premium eDiscovery. The remaining portion of subscribers either did not have access to eDiscovery or used the standard eDiscovery included in Office 365 E3.

• Standard eDiscovery and Collaboration Reactions

Standard eDiscovery utilizes the compliance records of Microsoft Teams that the Microsoft 365 substrate accumulates. These records are then stored in individual mailboxes in Exchange Online. This feature does not include reactions as part of its search results due to the lack of corresponding information in compliance records. Teams doesn’t register reactions to message edits in chats or channel conversations.

By the end of August 2022, with the cataloging of reactions in the unified audit log, Teams allowed tenant administrators to continually monitor the audit log for any new events. This resulted in the detection of the ReactedToMessage event, further facilitating the analysis of reactions for both chat and channel conversations.

• Understanding the ReactedToMessage Event

Although the AuditData information varies between chat and channel conversations, extracting relevant information from chat reactions is relatively simple. However, the data gathered for channel conversation reactions is slightly complex. An initial effort is required to identify the GUID for a team and subsequently the name of the channel where the reaction occurred. The Get-MgTeamChannel cmdlet comes into play here, retrieving all the channels in the team and filtering out the name of the desired channel.

Microsoft Teams does not register a unique operation code while removing a reaction from a message. If a user revises their initial reaction and makes a new one, two audit events are recorded. A minor tweak in the script as of 26 January 2023 can help you manage this situation.

• Locating Messages

If you need to associate a reaction with a message, you can use the message identifier. This code asks the Graph chatMessage API for a specific message and all its replies. It then checks the ones in the thread that have reactions and returns details about that message, its author, date posted, the text, and the interpreted reaction. This request requires the users to sign into the Microsoft Graph with the ChannelMessage.Read.All permission.

Teams reactions offer an opportunity to gauge whether individuals are using these reactions effectively, for example, determining the most popular reaction. Furthermore, these audit records could be paired with the standard eDiscovery to ascertain existing reactions for problematic messages detected through searches.

• Utilizing Collaboration Reactions

This comprehensive analysis of audit records reveals that collaboration reactions can be harnessed for numerous purposes. Apart from aiding in the daily functioning of businesses, it could be used to extract more profound insights through Microsoft Sentinel using the Office 365 connector and KQL query for reactions. However, deriving such insights requires a deep understanding of the technology and the capacity to look beyond what's apparent.

In conclusion, Microsoft Teams continues to evolve and support businesses in their functioning. The inclusion of Teams reactions in eDiscovery and the ability to monitor these reactions adds a new dimension to understanding conversations and offers beneficial insight. The collaboration platform truly has much to offer, and the Teams reactions feature is one among its many innovative developments.

More links on about Teams Reactions Captured in Audit Records

Teams Reactions Captured in Audit Records

Sep 8, 2022 — Teams captures an audit record and sends it to the Office 365 audit log. The Teams reactions audit records are an interesting source of ...

Using Teams Reactions Captured in Audit Records

Sep 8, 2022 — When people respond to a Teams chat or channel message with a reaction, Office 365 captures an audit record for the Teams reactions.

How to get a Teams report of reaction counts by members?

Feb 9, 2023 — Teams reactions can be retrieved from audit log. Here is a link ... Teams Reactions Captured in Audit Records. Please Note: Since the web ...

Keywords

Teams Audit Records, Reactions Captured Audit, Teams Reactions Audit, Captured Audit Records, Audit Records Reactions, Teams Audit Reactions, Audit Reactions Captured, Teams Captured Audit, Reactions in Audit Records, Audit Records for Teams