Forum Discussion
Office 365 Group history
If you want to retain Office 365 Audit Data for more than 3 months, buy an ISV reporting product like Radar Reporting, It keeps data for at least a year or longer if you need to.
To find remove actions, search the audit log for "Remove owner from group."
Search-UnifiedAuditLog -Operations "Remove owner from group" -StartDate 1-Jun-2018 -EndDate 26-Jun-2018
You can also find out what workload created an Office 365 group by searching the audit log. I even have details of how to do this in chapter 20 of Office 365 for IT Pros...
But you don't need to remove orphaned groups. Just give them a new owner and all is well.
One way is to look at the Office 365 audit log and check the Remove owner from group records.
Or take Paul Cunningham's script https://practical365.com/blog/help-test-v1-02-office-365-groups-report-script/ and amend it to track owner changes.
Thanks Tony for the quick reply, But there is no filter activity "Removed owner from group" in audit log search as well the audit logs available only for 3 months. So audit log approach will not help us because we need minimum 12 months data.
Paul Cunningham script is maintaining logs internally for tracing the change. If I use this script it may help for future occurrences but not helpful for past.
I decided the process the orphaned groups manually, its time taking but I feel it efficient than other approaches.
Please clarify below queries.
1. How to check which workload used for creating existing office 365 groups?
2. If I manually go and remove any orphaned group then what are the minimum dependency check that I will have to perform?
Thanks in advance,
K Senthilrajan
If you want to retain Office 365 Audit Data for more than 3 months, buy an ISV reporting product like Radar Reporting, It keeps data for at least a year or longer if you need to.
To find remove actions, search the audit log for "Remove owner from group."
Search-UnifiedAuditLog -Operations "Remove owner from group" -StartDate 1-Jun-2018 -EndDate 26-Jun-2018
You can also find out what workload created an Office 365 group by searching the audit log. I even have details of how to do this in chapter 20 of Office 365 for IT Pros...
But you don't need to remove orphaned groups. Just give them a new owner and all is well.
Many thanks Tony,
I am able to trace last one year data using the query you suggested for "Remove owner from group" This will resolve some of my orphaned groups.
All is well in Office 365 ;-)
