Identify which user deleted an O365 group?

[Darryl Felstead]

We recently had a group go AWOL, and though we were able to dig it up thanks to Restore-AzureADMSDeletedDirectoryObject, we are not able to identify how the group was deleted. Is there a way to pull relevant info from the site's settings (like a site collection's audit logs or similar)? I checked the version info for the pages/docs and nothing is listed at all.

[#2 · Accepted solution]

AzureAD's audit logs should show who deleted a group.

[#3]

Answered my own question after poking around this morning. Use the Audit Log Search from the "Security & Compliance" section of the admin console.

[#4]

Didn't see this reply. Thanks Steven!

[#5]

Hi ,

What kind of permission required to delete an sharepoint O365 group site.urgent please respond asap

Thnaks 

[#6]

Owners can delete their own group, or anyone with admin rights over your AzureAD.

In about 2 years of using Groups this has happened to us twice, simple to restore and then remove that user from having ownership.

[#7]

Searched the log based on Activity: Deleted team

[#8]

To identify who deleted the M365 Group, you can open the group in Microsoft Entra and then access the Audit logs.