Forum Discussion

Darryl Felstead's avatar
Darryl Felstead
Copper Contributor
Jun 12, 2017

Identify which user deleted an O365 group?

We recently had a group go AWOL, and though we were able to dig it up thanks to Restore-AzureADMSDeletedDirectoryObject, we are not able to identify how the group was deleted. Is there a way to pull relevant info from the site's settings (like a site collection's audit logs or similar)? I checked the version info for the pages/docs and nothing is listed at all.

 

  • To identify who deleted the M365 Group, you can open the group in Microsoft Entra and then access the Audit logs.
  • Tilo S's avatar
    Tilo S
    Copper Contributor
    Searched the log based on Activity: Deleted team
  • Amish Raj's avatar
    Amish Raj
    Copper Contributor

    Hi ,

    What kind of permission required to delete an sharepoint O365 group site.urgent please respond asap

     

    Thnaks 

    • Owners can delete their own group, or anyone with admin rights over your AzureAD.

       

      In about 2 years of using Groups this has happened to us twice, simple to restore and then remove that user from having ownership.

  • Darryl Felstead's avatar
    Darryl Felstead
    Copper Contributor
    Answered my own question after poking around this morning. Use the Audit Log Search from the "Security & Compliance" section of the admin console.

Resources