Forum Discussion
How can we find default owner of a Team
When there are Multiple owners for a Team, How can we find who created the Team (which I believe will the default owner)
-
Customer can push their Azure AD and O365 Unified Audit Log records to Azure Sentinel (Log Analytics under the hood). Who initiated the creation of an O365 Group / team as well as what endpoint (SPO, EXO, Teams, etc.) was it created from can be found with the following query in Azure AD audit logs in Log Analytics: https://github.com/BrianTJackett/log-analytics-samples/blob/master/Queries/Office365GroupCreationInitiatedBy.kqlYou might be able to find similar data directly through the Azure AD audit logs, but there is no Graph API call for that. The operation you would be looking for would be "Add group" though.
-
I would take a look at the top of the General channel for checking who created the first channel, if any, besides the General channel. It will say "NN created channel X" and hopefully that person was also the one having created the Team. Not foolproof, but hopefully useful to some degree.
