Table of contents
Teams chat is a core communication channel inside many organizations, and WorkSights captures high-level metadata from Microsoft 365 audit logs to reflect this activity accurately and privately. Chat events help show collaboration patterns without exposing message content or personal conversations.
What WorkSights Receives
WorkSights ingests metadata from Microsoft’s Unified Audit Log whenever a user engages in Teams chat. This includes:
- When a user sends a chat message
- When a user participates in a direct message (1:1) or group chat
- When a user creates or joins a chat thread
- Timestamps associated with chat activity
- Whether the chat involved internal or external participants
WorkSights does not receive:
- Message body text
- Images, attachments, reactions, or emojis
- Thread history or channel history
- Any content of private or group chats
Only the structural metadata needed to confirm that a communication event occurred.
How Teams Chats Appear in WorkSights
WorkSights displays Teams chat activity as short communication entries on the user’s timeline. To preserve a goal to show collaboration signals, each event reflects the moment of participation, not the full thread.
Chat activity includes:
- A Teams-specific color category
- A clear communication icon
- Lightweight timestamps
- Internal/external labeling when participant metadata is available
Multiple messages posted close together might be consolidated during WorkSights's overnight pass to reduce noise and avoid cluttering the timeline with micro-events.
This creates a clean and realistic representation of engagement rather than literal chat activity logs.
How WorkSights Classifies Teams Chats
WorkSights applies the same logic used across all communication integrations:
Internal Chat
All detectable participants are members of your Microsoft 365 domain.
External Chat
At least one participant has a different email domain.
Microsoft sometimes omits complete participant information for privacy reasons. In these cases, WorkSights marks the event with the best available classification without making assumptions.
Data Notes
WorkSights never ingests message content, chat bodies, attachments, or reactions.
Only activity originating from mapped users appears on the WorkSights timeline.
Chat activity represents participation, not the volume or substance of the conversation.
System-generated or automated chat notifications are filtered to prevent noise.
If Microsoft delivers delayed audit entries, WorkSights adjusts timestamps automatically during nightly cleanup.
Next Steps
For audit log configuration requirements, see Microsoft 365 Audit Log Activation.
For connection details, see Connecting Microsoft 365.
For a platform-level explanation of Microsoft 365 activity in WorkSights, see Microsoft 365 Overview.