Forum Discussion

Iron Contributor

Nov 12, 2019

Solved

How can we find default owner of a Team

When there are Multiple owners for a Team, How can we find who created the Team (which I believe will the default owner)

microsoft teams

Ashish Trivedi
Nov 13, 2019
Maheshwar Tayal

Customer can push their Azure AD and O365 Unified Audit Log records to Azure Sentinel (Log Analytics under the hood). Who initiated the creation of an O365 Group / team as well as what endpoint (SPO, EXO, Teams, etc.) was it created from can be found with the following query in Azure AD audit logs in Log Analytics: https://github.com/BrianTJackett/log-analytics-samples/blob/master/Queries/Office365GroupCreationInitiatedBy.kql

You might be able to find similar data directly through the Azure AD audit logs, but there is no Graph API call for that. The operation you would be looking for would be "Add group" though.

Ashish Trivedi

Brass Contributor

Nov 13, 2019

Maheshwar Tayal

Customer can push their Azure AD and O365 Unified Audit Log records to Azure Sentinel (Log Analytics under the hood). Who initiated the creation of an O365 Group / team as well as what endpoint (SPO, EXO, Teams, etc.) was it created from can be found with the following query in Azure AD audit logs in Log Analytics: https://github.com/BrianTJackett/log-analytics-samples/blob/master/Queries/Office365GroupCreationInitiatedBy.kql

You might be able to find similar data directly through the Azure AD audit logs, but there is no Graph API call for that. The operation you would be looking for would be "Add group" though.

Maheshwar Tayal
Iron Contributor
Nov 14, 2019
Ashish Trivedi
Thanks!
How long by default Audit Log history can store in case we do not use Azure Sentinel.
My Teams were created 2 years back, can we still get default owner details

Thanks!