A customer reached out to me recently and asked where some files came from on a SharePoint Teams site (the automatically-created site from when you create a team in Microsoft Teams). I took a look and I saw that they were uploaded by a "SharePoint App" user. Here's what it looks like in Teams:

List of files uploaded simultaneously by "SharePoint App"

And from the SharePoint site itself:

The same files as before, still showing uploaded by "SharePoint App"

I understand this is likely someone using an app to upload files, but I need to know the real user who did this (there are scores of users who have access to this site and the files' contents are not indicative of who might have uploaded them).

Looking at the properties, I do see some different information about a "Microsoft Teams Mailhook", but still not identifying:

Screenshot of file properties view depicting 'Microsoft Teams Mailhook' as the responsible entity

How can I determine the real person who uploaded these files?

2 Answers 2


If you are seeing "SharePoint App" as Created By that means that files are uploaded using "SharePoint App Only Context" i.e. some other application is uploading document without any username and password but using Client Id and Secret key.

So here you can't get actual user's details.

Using App Modified By and App Created By column value you can get using which App, those operations are being done. In case of your screen shot which you have posted, it seems that application name is Microsoft Teams mailhook.

enter image description here

Once you identify app name, go to your Enterprise Applications pages in your Azure Active directory.

enter image description here

  • Hi Kalpesh, did you intend to end the answer where it currently ends? Or did you mean to include more steps after arriving at AAD. I'm assuming I should be looking for "Microsoft Teams Mailhook" in the Enterprise applications section of AAD but I'm not sure (there could be lots of steps between those two points).
    – TylerH
    Sep 2, 2022 at 14:27
  • yes. my answer it finished. I have provided my answer with assumption that you do have some knowledge about Azure App Registration. You can find details steps to open Enterprise application at this link. Sep 13, 2022 at 7:14
  • Thanks, that's the problem though. If the answer to the question is to go to X and do Y, you should not assume knowledge with Y, otherwise I likely wouldn't have needed to ask the question in the first place. It's a bit like answering "how do I start my car" with "open the door, then sit in the driver seat" and then stopping there because you assume the person is familiar with where the ignition switch is or how to operate it. I can upvote this answer because it confirmed what I suspected but it's only part of the roadmap, so I can't accept it.
    – TylerH
    Sep 13, 2022 at 13:54
  • BTW, "Microsoft Teams Mailhook" is not listed under Enterprise Applications; I had to remove that filter when searching All Applications to find it.
    – TylerH
    Sep 13, 2022 at 13:55

Contributing some additional info to the thread: It is possible to send an email to a Microsoft Teams channel. If you right-click a channel you will see the option "Get email address".

Emails sent to a Teams channel are saved as folders within the channel's folder in the Shared Documents library of the SharePoint site that supports the Teams. The folder will contain a copy of the email message and any attachments included with the email. The Created by and Modified by columns of the folder and the files within will display "SharePoint App".

  • "folders within the channel's folder in the Shared Documents library of the SharePoint site" Can you provide a screenshot of what one of these directory paths looks like?
    – TylerH
    Feb 7 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.