Microsoft Teams Meeting Lobby Admission Tracking
This KQL query identifies which participants joined the Microsoft Teams meeting from the lobby and who admitted them. MeetingParticipantName: the meeting participant who waited in the lobby InviteTime: the time the participant entered the meeting but was waiting in the lobby Inviter: the person who admitted the participant from the lobby MeetingParticipantJoinTime: the time the participant was admitted from the lobby Important caveat: There can be a significant delay (e.g., more than 8 hours) between when a Teams meeting occurs and when the corresponding events become available in Advanced Hunting.
Microsoft Sentinel (KQL)
