SOLVED

Identify which user deleted an O365 group?

%3CLINGO-SUB%20id%3D%22lingo-sub-77064%22%20slang%3D%22en-US%22%3EIdentify%20which%20user%20deleted%20an%20O365%20group%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-77064%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20recently%20had%20a%20group%20go%20AWOL%2C%20and%20though%20we%20were%20able%20to%20dig%20it%20up%20thanks%20to%20Restore-AzureADMSDeletedDirectoryObject%2C%20we%20are%20not%20able%20to%20identify%20how%20the%20group%20was%20deleted.%20Is%20there%20a%20way%20to%20pull%20relevant%20info%20from%20the%20site's%20settings%20(like%20a%20site%20collection's%20audit%20logs%20or%20similar)%3F%20I%20checked%20the%20version%20info%20for%20the%20pages%2Fdocs%20and%20nothing%20is%20listed%20at%20all.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-77064%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%20Groups%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-327493%22%20slang%3D%22en-US%22%3ERe%3A%20Identify%20which%20user%20deleted%20an%20O365%20group%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-327493%22%20slang%3D%22en-US%22%3ESearched%20the%20log%20based%20on%20Activity%3A%20Deleted%20team%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-183554%22%20slang%3D%22en-US%22%3ERe%3A%20Identify%20which%20user%20deleted%20an%20O365%20group%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-183554%22%20slang%3D%22en-US%22%3E%3CP%3EOwners%20can%20delete%20their%20own%20group%2C%20or%20anyone%20with%20admin%20rights%20over%20your%20AzureAD.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20about%202%20years%20of%20using%20Groups%20this%20has%20happened%20to%20us%20twice%2C%20simple%20to%20restore%20and%20then%20remove%20that%20user%20from%20having%20ownership.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-183500%22%20slang%3D%22en-US%22%3ERe%3A%20Identify%20which%20user%20deleted%20an%20O365%20group%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-183500%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%2C%3C%2FP%3E%3CP%3EWhat%20kind%20of%20permission%20required%20to%20delete%20an%20sharepoint%20O365%20group%20site.urgent%20please%20respond%20asap%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThnaks%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-77083%22%20slang%3D%22en-US%22%3ERe%3A%20Identify%20which%20user%20deleted%20an%20O365%20group%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-77083%22%20slang%3D%22en-US%22%3EDidn't%20see%20this%20reply.%20Thanks%20Steven!%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-77082%22%20slang%3D%22en-US%22%3ERe%3A%20Identify%20which%20user%20deleted%20an%20O365%20group%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-77082%22%20slang%3D%22en-US%22%3EAnswered%20my%20own%20question%20after%20poking%20around%20this%20morning.%20Use%20the%20Audit%20Log%20Search%20from%20the%20%22Security%20%26amp%3B%20Compliance%22%20section%20of%20the%20admin%20console.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-77078%22%20slang%3D%22en-US%22%3ERe%3A%20Identify%20which%20user%20deleted%20an%20O365%20group%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-77078%22%20slang%3D%22en-US%22%3E%3CP%3EAzureAD's%20audit%20logs%20should%20show%20who%20deleted%20a%20group.%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

We recently had a group go AWOL, and though we were able to dig it up thanks to Restore-AzureADMSDeletedDirectoryObject, we are not able to identify how the group was deleted. Is there a way to pull relevant info from the site's settings (like a site collection's audit logs or similar)? I checked the version info for the pages/docs and nothing is listed at all.

 

6 Replies
best response confirmed by Christophe Fiessinger (Microsoft)
Solution

AzureAD's audit logs should show who deleted a group.

Answered my own question after poking around this morning. Use the Audit Log Search from the "Security & Compliance" section of the admin console.
Didn't see this reply. Thanks Steven!

Hi ,

What kind of permission required to delete an sharepoint O365 group site.urgent please respond asap

 

Thnaks 

Owners can delete their own group, or anyone with admin rights over your AzureAD.

 

In about 2 years of using Groups this has happened to us twice, simple to restore and then remove that user from having ownership.

Searched the log based on Activity: Deleted team