Fix Teams Audit Log Does Not Show a Meeting Event for a Guest Conversation

When you search the Microsoft 365 audit log for a Teams meeting that included external guests, the meeting event may not appear. This is a common gap because guest conversations are stored differently than internal ones. The issue usually comes from the meeting being recorded as a conversation event rather than a standard meeting event. This article explains why the audit log misses the meeting and how to find the actual record.

You will learn the exact steps to enable the correct audit log categories and filter for guest-related activity. You will also see alternative ways to locate the meeting data when the standard search fails. The goal is to give you a reliable method for compliance and security reviews.

Why the Audit Log Does Not Show a Meeting Event for a Guest Conversation

The Microsoft 365 audit log records Teams activities, but the way it logs a guest meeting is different from an internal meeting. When an external guest joins a Teams meeting, the system often logs the activity as a conversation event under the guest’s user record. This happens because the guest is added as an external participant, not as a member of the organization. The meeting event itself may not get a separate entry.

Another reason is that the audit log categories must be enabled in the Microsoft Purview portal. If the Teams meetings category is turned off, the meeting events are not captured at all. Even if the category is on, the search interface may filter out guest-related events by default. The search bar expects a specific user ID or activity name, and the guest’s UPN is not in the organization’s directory.

How Guest Conversations Are Logged

When a guest participates in a meeting, the audit record appears under the Conversation activity type. The record includes the guest’s email address and the meeting ID. However, the standard audit log search for “Meeting” may not show this because the activity name is different. You need to search for the guest’s email directly.

Steps to Find the Missing Meeting Event in the Audit Log

Follow these steps to locate the meeting event for a guest conversation.

1. Enable auditing in Microsoft Purview
   Go to Microsoft Purview > Audit. If auditing is not enabled, click Start recording user and admin activity. Wait up to 24 hours for the setup to complete.
2. Select the Teams meetings category
   In the audit search page, click Search. Under Activities, choose Teams meetings and events. This category includes meeting created, meeting ended, and meeting participant joined events.
3. Search by the guest’s email address
   In the User field, type the guest’s full email address. Do not use the display name. Click Search. This filters for all activities related to that guest, including conversation events.
4. Look for the Conversation activity type
   In the results, find entries where the Activity column shows Conversation. Open the record to see the meeting ID and the participants list. This is the meeting event record for the guest conversation.
5. Use the date range filter
   Set the Start date and End date around the meeting time. Guest meetings may appear with a delay, so extend the range by one day on both sides.
6. Export the results
   Click Export and choose Download all results. The CSV file includes the Item column with the full JSON data. Search the JSON for the meeting ID to confirm the event.

Alternative: Use PowerShell to Search the Audit Log

If the portal search still misses the event, use PowerShell with the Search-UnifiedAuditLog cmdlet. This gives you more control over the filters.

1. Connect to Exchange Online
   Run Connect-ExchangeOnline and sign in with an account that has audit log permissions.
2. Run the audit log search
   Use this command: Search-UnifiedAuditLog -StartDate 2025-01-01 -EndDate 2025-01-02 -UserIds guest@example.com -Operations Conversation. Replace the dates and email.
3. Review the output
   Look for the AuditData property. It contains a JSON string with the meeting ID. Save the output to a file if needed.

If the Audit Log Still Does Not Show the Meeting Event

Teams audit log shows no events for a guest at all

This happens when guest access is restricted in the Teams admin center. Go to Teams admin center > Users > External access. Check that Allow external users is enabled. If it is off, guest meetings are not logged.

Meeting event appears but without the guest name

The audit log may record the meeting under the organizer’s name only. Search by the organizer’s email and look for the MeetingParticipantDetail JSON. This field lists all participants, including guests.

Guest conversation event is missing from the CSV export

The CSV export may truncate long fields. Use the Search-UnifiedAuditLog cmdlet with the ResultSize parameter set to a high number, such as 5000. Then filter the output for the guest’s email.

Teams Audit Log Search vs PowerShell Search: Key Differences

Item	Microsoft Purview Audit Search	PowerShell Search-UnifiedAuditLog
User interface	Web portal with graphical filters	Command line with scriptable filters
Guest email search	Works if you type the full UPN	Works with the UserIds parameter
Activity types	Limited to predefined categories	Supports any operation string, including Conversation
Export format	CSV with JSON in the Item column	PowerShell objects with AuditData property
Result size limit	Up to 50,000 records per export	Set with the ResultSize parameter

Now you know why the audit log misses guest meeting events and how to retrieve them. Start by enabling the Teams meetings category in Purview, then search by the guest’s email. If that fails, use PowerShell to pull the exact record. For advanced compliance work, set up a custom audit log retention policy to keep guest meeting data longer.