Office 365 Audit for Created Group triggers for non-group creation

[Ed Hansberry]

In trying to get our Office 365 Groups to stop multiplying like rabbits, I set up an audit alert for "Created Group" under Site Permissions. It is to mainly trap when someone creates a Planner in the Planner URL vs inside of Teams. The former creates an entirely new group. The latter just creates another Planner in the Group for the team.

But this morning I got an alert that someone created a group that has existed for 2+ years. So then I looked at the audit log for "Created Group" going back 2 weeks, and there are a few dozen entries, and not a one is a new group. One is even mine and looking at the group that was "created' it is my OneDrive for Business account.

https://TENANTNAME-my.sharepoint.com/personal/ed_hansberry_COMPANY_com

Obviously I didn't create a group here. 

So...

1. what is this audit type actually auditing and
2. How can I find out when a Office 365 Group is actually created?

[#2]

1. Created group = Site administrator or owner creates a group for a site, or performs a task that results in a group being created. For example, the first time a user creates a link to share a file, a system group is added to the user's OneDrive for Business site. This event can also be a result of a user creating a link with edit permissions to a shared file.

2. You should look for "Added group"

https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-c...