Forum Discussion
Office 365 Group history
If you want to retain Office 365 Audit Data for more than 3 months, buy an ISV reporting product like Radar Reporting, It keeps data for at least a year or longer if you need to.
To find remove actions, search the audit log for "Remove owner from group."
Search-UnifiedAuditLog -Operations "Remove owner from group" -StartDate 1-Jun-2018 -EndDate 26-Jun-2018
You can also find out what workload created an Office 365 group by searching the audit log. I even have details of how to do this in chapter 20 of Office 365 for IT Pros...
But you don't need to remove orphaned groups. Just give them a new owner and all is well.
Hello Senthilrajan Kaliyaperumal,
It's not possible to trace last one year data using 'Search-UnifiedAuditLog' cmdlet. The RemoveOwner event might be happened in past 90 days so that you traced it.
Can you please confirm it? else people who read this post in future will get confused.
As Tony suggested it's good to deploy a script or have an ISV tool to preserve the audit trail for a longer period. You may take a look at https://admindroid.com to preserve audit log over past 90 days.
Yes, That is true. The log fetched only for last 90 days. Find the PS script below.
$Username = "sk@kmsys.onmicrosoft.com"
$Password = ConvertTo-SecureString '<password>' -AsPlainText -Force
$UserCredential = New-Object System.Management.Automation.PSCredential $Username, $Password
$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $session
Connect-MsolService -Credential $UserCredential
$OutputFile = "C:\Appl\output\Usage-log4.txt"
Search-UnifiedAuditLog -EndDate $((Get-Date)) -StartDate $((Get-Date).AddDays(-90)) -Operations "Remove owner from group"| Export-Csv $OutputFile -NoTypeInformation -Append
Remove-PSSession $session