SOLVED
Home

How can we find default owner of a Team

%3CLINGO-SUB%20id%3D%22lingo-sub-1002534%22%20slang%3D%22en-US%22%3EHow%20can%20we%20find%20default%20owner%20of%20a%20Team%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1002534%22%20slang%3D%22en-US%22%3E%3CP%3EWhen%20there%20are%20Multiple%20owners%20for%20a%20Team%2C%20How%20can%20we%20find%20who%20created%20the%20Team%20(which%20I%20believe%20will%20the%20default%20owner)%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1002534%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EMicrosoft%20Teams%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1002576%22%20slang%3D%22en-US%22%3ERe%3A%20How%20can%20we%20find%20default%20owner%20of%20a%20Team%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1002576%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F45060%22%20target%3D%22_blank%22%3E%40Maheshwar%20Tayal%3C%2FA%3E%20%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20not%20seen%20a%20distinction%20between%20an%20owner%20and%20the%20owner%20that%20created%20the%20team.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOne%20way%20for%20sure%20to%20tell%20who%20created%20the%20team%20is%20to%20look%20in%20the%20audit%20logs%20in%20the%20security%20and%20compliance%20centre%20and%20use%20the%20%22Create%20Team%22%20action.%20%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EGenerally%20the%20Owner%20is%20the%20first%20person%20to%20post%20to%20the%20team%20about%20creating%20tabs%20etc.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20that%20helps%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1004286%22%20slang%3D%22en-US%22%3ERe%3A%20How%20can%20we%20find%20default%20owner%20of%20a%20Team%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1004286%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%3C%2FP%3E%3CP%3EAudit%20logs%20are%20not%20for%20ever%3C%2FP%3E%3CP%3Eso%20is%20there%20any%20other%20way%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1004933%22%20slang%3D%22en-US%22%3ERe%3A%20How%20can%20we%20find%20default%20owner%20of%20a%20Team%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1004933%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F45060%22%20target%3D%22_blank%22%3E%40Maheshwar%20Tayal%3C%2FA%3E%20%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENot%20that%20I%20know%20of.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAndy%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1007003%22%20slang%3D%22en-US%22%3ERe%3A%20How%20can%20we%20find%20default%20owner%20of%20a%20Team%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1007003%22%20slang%3D%22en-US%22%3EI%20would%20take%20a%20look%20at%20the%20top%20of%20the%20General%20channel%20for%20checking%20who%20created%20the%20first%20channel%2C%20if%20any%2C%20besides%20the%20General%20channel.%20It%20will%20say%20%22NN%20created%20channel%20X%22%20and%20hopefully%20that%20person%20was%20also%20the%20one%20having%20created%20the%20Team.%20Not%20foolproof%2C%20but%20hopefully%20useful%20to%20some%20degree.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1007080%22%20slang%3D%22en-US%22%3ERe%3A%20How%20can%20we%20find%20default%20owner%20of%20a%20Team%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1007080%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F45060%22%20target%3D%22_blank%22%3E%40Maheshwar%20Tayal%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CDIV%3E%0A%3CDL%20style%3D%22box-sizing%3A%20border-box%3B%20font-family%3A%20'Segoe%20UI'%2C%20'Helvetica%20Neue'%2C%20'Apple%20Color%20Emoji'%2C%20'Segoe%20UI%20Emoji'%2C%20Helvetica%2C%20Arial%2C%20sans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant-ligatures%3A%20normal%3B%20font-variant-caps%3A%20normal%3B%20font-weight%3A%20400%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20start%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20white-space%3A%20normal%3B%20widows%3A%202%3B%20word-spacing%3A%200px%3B%22%3E%0A%3CDD%3E%0A%3CDIV%3ECustomer%20can%20push%20their%20Azure%20AD%20and%26nbsp%3BO365%20Unified%20Audit%20Log%20records%20to%20Azure%20Sentinel%20(Log%20Analytics%20under%20the%20hood).%26nbsp%3B%20Who%20initiated%20the%20creation%20of%20an%20O365%20Group%20%2F%20team%20as%20well%20as%20what%20endpoint%20(SPO%2C%20EXO%2C%20Teams%2C%20etc.)%20was%20it%20created%20from%20can%20be%20found%20with%20the%20following%20query%20in%20Azure%20AD%20audit%20logs%20in%26nbsp%3BLog%20Analytics%3A%20%3CA%20title%3D%22https%3A%2F%2Fgithub.com%2Fbriantjackett%2Flog-analytics-samples%2Fblob%2Fmaster%2Fqueries%2Foffice365groupcreationinitiatedby.kql%22%20href%3D%22https%3A%2F%2Fgithub.com%2FBrianTJackett%2Flog-analytics-samples%2Fblob%2Fmaster%2FQueries%2FOffice365GroupCreationInitiatedBy.kql%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FBrianTJackett%2Flog-analytics-samples%2Fblob%2Fmaster%2FQueries%2FOffice365GroupCreationInitiatedBy.kql%3C%2FA%3E%3C%2FDIV%3E%0A%3CDIV%3EYou%20might%20be%20able%20to%20find%20similar%20data%20directly%20through%20the%20Azure%20AD%20audit%20logs%2C%20but%20there%20is%20no%20Graph%20API%20call%20for%20that.%26nbsp%3B%20The%20operation%20you%20would%20be%20looking%20for%20would%20be%20%22Add%20group%22%20though.%3C%2FDIV%3E%0A%3C%2FDD%3E%0A%3C%2FDL%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1007378%22%20slang%3D%22en-US%22%3ERe%3A%20How%20can%20we%20find%20default%20owner%20of%20a%20Team%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1007378%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1507%22%20target%3D%22_blank%22%3E%40Ashish%20Trivedi%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3CP%3EHow%20long%20by%20default%20Audit%20Log%20history%20can%20store%20in%20case%20we%20do%20not%20use%20Azure%20Sentinel.%3C%2FP%3E%3CP%3EMy%20Teams%20were%20created%202%20years%20back%2C%20can%20we%20still%20get%20default%20owner%20details%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E
Frequent Contributor

When there are Multiple owners for a Team, How can we find who created the Team (which I believe will the default owner)

6 Replies

Hi @Maheshwar Tayal ,

 

I have not seen a distinction between an owner and the owner that created the team.

 

One way for sure to tell who created the team is to look in the audit logs in the security and compliance centre and use the "Create Team" action.  

 

Generally the Owner is the first person to post to the team about creating tabs etc. 

 

Hope that helps

 

Hi

Audit logs are not for ever

so is there any other way

 

Thanks!

Hi @Maheshwar Tayal ,

 

Not that I know of. 

 

Andy

I would take a look at the top of the General channel for checking who created the first channel, if any, besides the General channel. It will say "NN created channel X" and hopefully that person was also the one having created the Team. Not foolproof, but hopefully useful to some degree.
Solution

@Maheshwar Tayal 

Customer can push their Azure AD and O365 Unified Audit Log records to Azure Sentinel (Log Analytics under the hood).  Who initiated the creation of an O365 Group / team as well as what endpoint (SPO, EXO, Teams, etc.) was it created from can be found with the following query in Azure AD audit logs in Log Analytics: https://github.com/BrianTJackett/log-analytics-samples/blob/master/Queries/Office365GroupCreationIni...
You might be able to find similar data directly through the Azure AD audit logs, but there is no Graph API call for that.  The operation you would be looking for would be "Add group" though.

@Ashish Trivedi 

Thanks!

How long by default Audit Log history can store in case we do not use Azure Sentinel.

My Teams were created 2 years back, can we still get default owner details

 

Thanks!

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies