Identifying the creator of an Microsoft Team (Who created this Team)

This really sounds like its available out of the box right there in the group’s metadata column, apparently its not. You can see who the current admin is, but not the original creator (although usually that is probably the same). In PowerShell there is a property for “Created On” but no “Created By“.

magnifying-find-agent-lw

In my case, I had to find out the creator of a specific Microsoft Team but Teams didn’t have the metadata of the Creator so the only way to find out seemed by tracing the Office 365 Audit Logs.

Office 365 Audit Logs can get you plenty of information which you can’t observe directly from the workload UI or PowerShell.

First and foremost, in order to extract the logging details, Audit Log capability must be running in your tenant.

audit

Use this command via PowerShell to enable it if you haven’t. And, after enabling you must wait for a while to allow the logs analytics component to record the logs (won’t be available immediately)

Connect-ExchangeOnline
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

Detailed information of enabling/disabling Auditing in Office 365 is right here – https://docs.microsoft.com/en-us/microsoft-365/compliance/turn-audit-log-search-on-or-off?view=o365-worldwide

Searching for activities (Teams Creation in this case)

Head on to protection.office.com and navigate Search –> Audit Log Search

log search

Created Team” log activity is available under Microsoft Teams category in the Audit Log. You can simply type “Teams” to get the category and choose the event type underneath it.

created

Define the time period, select the activity type and search –> And there is it ! I now have the details I was looking for.

Team0This simply allow us to see the creation details of any Team within this tenant.

Team1

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s