Azure AD

How to Find Deleted Microsoft 365 Groups

Microsoft 365 groups are essential for collaboration within an organization. However, the accidental deletion of groups can disrupt workflows and lead to the loss of group-connected teams, SharePoint sites, and other resources. Prompt identification and restoration of these deleted groups is essential to prevent communication breakdowns and data loss. In this guide, we will show you how to effectively audit deleted groups in Microsoft 365.

Using Microsoft 365 Admin Center

Microsoft 365 Permission Required

Groups Admin Least Privilege

Global Admin Most Privilege

Log in to the Microsoft 365 admin center.
Navigate to Deleted groups under Teams & groups.
Here, you can view the Microsoft 365 groups that were deleted within the last 30 days.

Using Microsoft Entra Admin Center

Microsoft 365 Permission Required

Groups Admin Least Privilege

Global Admin Most Privilege

Sign-in to the Microsoft Entra admin center.
Navigate to Deleted groups under Identity»Groups to check the deleted groups in Microsoft Entra ID.

Using Microsoft Graph PowerShell

Microsoft 365 Permission Required

Groups Admin Least Privilege

Global Admin Most Privilege

Connect to the Microsoft Graph PowerShell module using the below cmdlet.
Windows PowerShell
```
 Connect-MgGraph -Scopes Group.Read.All
```
Run the below cmdlet to get the list of all deleted groups in Microsoft 365.
Windows PowerShell
```
 Get-MgDirectoryDeletedItemAsGroup
```

Using AdminDroid
Simple & Quick

AdminDroid Permission Required Delegated

Any user with report access delegated by the Super Admin.

Log in to the AdminDroid Office 365 reporter.
Navigate to the Recently Deleted Groups report under Reports»Azure AD»Group Reports.

AdminDroid Azure AD Reporter

Audit deleted Microsoft 365 groups to investigate unintentional group deletions!

AdminDroid's Microsoft 365 group auditing tool offers detailed insights into various group-related activities like Microsoft 365 group creations, modifications, deletions, group setting changes, and more. Effortlessly monitor deleted groups to detect any unintentional removals and safeguard critical resources.

Group Dashboard for Visualizing Deleted Groups

With AdminDroid's Microsoft 365 group dashboard, visualize and check Microsoft 365 deleted groups to recover or permanently delete them to free up space.

Identify Inactive Group Mailboxes in M365

Track inactive group mailbox report to find last activity time of a group mailbox and delete the unused ones to optimize M365 environment.

Monitor Microsoft 365 Group Usage

Regularly monitor Microsoft 365 group usage and activities reports to ensure that only approved and active groups exist within your organization.

Manage Empty Groups in Microsoft 365

Investigate empty groups in Microsoft 365 and delete any unnecessary ones to maintain only essential groups in your M365 environment.

Get Instant Alerts on Group Deletion with AdminDroid

Receive real-time notifications with AdminDroid’s alerting whenever a Microsoft 365 group is deleted. This helps to take timely investigation to avoid unwanted deletions.

Get Group Audit Report in Microsoft 365

Regularly monitor Microsoft 365 group audit reports to ensure no accidental deletions or restorations occur and safeguard your organization’s group resources.

In conclusion, AdminDroid's Azure AD management tool provides a streamlined solution for tracking deleted groups. With its detailed reports and automated monitoring, you can easily identify accidental deletions and ensure critical group resources are preserved.

Explore a full range of reporting options

Download Live Demo

Important Tips

Monitor Microsoft 365 group creations to identify and delete unwanted groups, ensuring that only relevant groups remain in your organization.

Apply retention policies to Microsoft 365 groups to ensure that content is retained in the Preservation Hold Library of SharePoint Online and OneDrive, even after the group is deleted.

Audit Microsoft 365 file deletions when a group is deleted to check whether any critical file has been removed from the SharePoint Online.

Common Errors and Resolution Steps

The following are the possible errors and troubleshooting hints while exporting deleted groups in Microsoft 365.

Error Get-MgDirectoryDeletedItemAsGroup : Insufficient privileges to complete the operation. Status: 403 (Forbidden) ErrorCode: Authorization_RequestDenied

This error occurs when the 'Connect-MgGraph' cmdlet is executed without specifying the required scopes.

Fix Define the necessary scopes when connecting to the Microsoft Graph module.

Connect-MgGraph –Scopes Group.Read.All

Error Restore-MgBetaDirectoryDeletedItem : Invalid object identifier '4765-543587-5454-4522'. Status: 400 (BadRequest) ErrorCode: Request_BadRequest

This error occurs if the 'Restore-MgDirectoryDeletedItem' cmdlet is used with an incorrect object ID.

Fix Verify that the object ID is valid. Use the following cmdlet to list all deleted groups with their display names and object IDs.

Get-MgDirectoryDeletedItemAsGroup | Select DisplayName,Id
#After running the above cmdlet, execute the below cmdlet with the correct object ID obtained from the previous cmdlet.
Restore-MgDirectoryDeletedItem -DirectoryObjectId "<objectId>"

Error Write-ErrorMessage : Cannot process argument transformation on parameter 'EndDate'. Cannot convert value "31/10/2024" to type "Microsoft.Exchange.ExchangeSystem.ExDateTime".

This error occurs when you enter the date in the incorrect format while specifying the start date or end date in 'Search-UnifiedAuditLog' cmdlet.

Fix Enter the date in the MM/DD/YYYY format while executing 'Search-UnifiedAuditLog' cmdlet in Exchange Online PowerShell.

Error Failed to restore group. Insufficient privileges to restore some or all of the selected groups.

This error occurs in the Microsoft Entra admin center when attempting to restore a deleted group without the required admin permissions.

Fix Ensure you have sufficient permissions. Read-only roles cannot restore groups. You must have Global Admin or User Admin rights to restore a group.

Azure AD

Frequently Asked Questions

Promptly Recover Deleted Microsoft 365 Groups to Prevent Data Loss!

What happens when you delete a Microsoft 365 group?

Microsoft 365 admins may occasionally delete groups that are no longer needed while managing groups. However, deleting a group can have significant effects across various Microsoft 365 services.

Here's a detailed breakdown of what happens when a Microsoft 365 group is deleted.

Impact on group and its memberships: Deleting a Microsoft 365 group removes the group object from Microsoft Entra ID along with the memberships, roles, and permissions linked to the group.
Loss of shared inbox and calendar: The group's shared inbox and calendar are deleted. Any emails, events, or meeting schedules stored within these resources will be lost.
Removal of SharePoint team site access: Since the group-connected SPO site will be disconnected from the group, admins can't control the setting in Microsoft 365 admin center. They need to provide access to users again from the SharePoint admin center.
Impact on OneNote notebook: The OneNote notebook linked to the group remains stored in the SharePoint team site. However, users are able to access the notebook only based on the site's permission settings.
Deletion of Microsoft Teams workspace: If the group is associated with a Microsoft Teams workspace, deleting the group will remove the associated team, chats, files, and conversations within that team. However, data can be recovered if you restore the group or team within the soft deletion period (by default it is 30 days).
Removal of associated email addresses: All email addresses associated with the group, including the primary address and any aliases, will be deleted.

How to see who deleted a Microsoft 365 group?

As an admin, it's crucial to monitor Microsoft 365 group's activities to ensure effective collaboration and secure access to resources. Understanding who deleted a Microsoft 365 group allows you to identify admins who don't need deletion permissions and adjust their privileges to enhance security.

Tracking who deleted a user in Microsoft 365 can be done in the following ways.

Steps to find who deleted a M365 group using Microsoft Purview portal

Navigate to the Audit page, then specify the date and time range as per your requirements.
Click on the Activity-friendly names drop-down and select Deleted group under 'Microsoft Entra group administration activities'.
Then, click on Search. Once the search is completed, you can export the audit logs of Microsoft 365 deleted groups with the admins who performed the deletion operation.

Steps to find who deleted a M365 group using Exchange Online PowerShell

Connect to the Exchange Online PowerShell module using the cmdlet below.
```
Connect-ExchangeOnline
```

Run the below cmdlet to get the audit logs of group deletion activity in Microsoft 365.

Search-UnifiedAuditLog -StartDate MM/DD/YYYY -EndDate MM/DD/YYYY -Operations "Delete group" | Format-Table

Tracking deleted groups in Microsoft 365 audit logs can be time-consuming since the exported results are not user-friendly.

Effortlessly find who deleted a Microsoft 365 group with AdminDroid!

With AdminDroid's Audit Deleted Groups report, you can track the Microsoft 365 group deletion activities and their properties easily.
This report shows the group deletion activities in the organization with information like deletion time, deleted group name, who deleted the group, etc.

How to restore a deleted Microsoft 365 group?

If a project group is accidentally deleted, team members may lose access to documents, group email messages, calendars, and channels. However, you can quickly restore a deleted Microsoft 365 group to regain access of removed resources and ensure the sensitive information are safe.

Steps to recover a deleted Microsoft 365 group in the Microsoft Entra admin center

Navigate to Deleted groups under Identity»Groups.
Select the group you want to restore and click the Restore group option.
Then, click 'Yes' in the pop-up menu to restore a deleted group in Microsoft 365.

Steps to retrieve a deleted Microsoft 365 group using Microsoft Graph PowerShell

Connect to the Microsoft Graph PowerShell module and restore a group using the cmdlets below.

Connect-MgGraph –Scopes Group.ReadWrite.All
Restore-MgDirectoryDeletedItem -DirectoryObjectId "<objectId>"
#Replace the "<objectId>" with the Id of the respective deleted group.

While Microsoft 365 admin portals lack dedicated reports to audit group restoration activities, AdminDroid offers a robust solution!

With AdminDroid's Restored Groups Audit report, you can effortlessly audit group restoration activities and ensure no unintended group restoration activities are performed.
This report includes details, such as the name of the restored group, the restoration time, the user who restored the group, and more.

Can admins retain Microsoft 365 groups resources for a specific period?

By configuring a retention policy, you can retain Microsoft 365 group resources for a specific period. This ensures that important data, such as emails, files, site access, and team conversations remains safe and prevent the permanent loss of valuable information.

Let's see how to configure a retention policy for group contents in Microsoft 365.

Log in to the Microsoft Purview portal and navigate to Data lifecycle management»Microsoft 365»Retention policies.
Click on '(+) New retention policy' option and give your policy a name and description.
If needed, choose specific 'Admin Units' to apply this retention policy. However, if you need to apply this policy organizational wide, just click 'Next'.
Select Static to manually assign it to specific groups or locations.
Enable the toggle for 'Microsoft 365 Group mailboxes & sites' in the locations and then click 'Next'.
In the retention settings, select 'Retain item for a specific period' and set how long the group's content should be retained.
Specify 'Start the retention period based on' when it was created or when it was modified.
Then, choose 'automatically delete the content after this period' or 'do nothing' after the retention period.
Review all the configured settings and click "Submit" to create the retention policy.

Note: Items that are currently older than the specified retention period will be deleted after you turn on this policy.

How to Find Deleted Microsoft 365 Groups

Using Microsoft 365 Admin Center

Using Microsoft Entra Admin Center

Using Microsoft Graph PowerShell

Using AdminDroid Simple & Quick

Audit deleted Microsoft 365 groups to investigate unintentional group deletions!

Group Dashboard for Visualizing Deleted Groups

Identify Inactive Group Mailboxes in M365

Monitor Microsoft 365 Group Usage

Manage Empty Groups in Microsoft 365

Get Instant Alerts on Group Deletion with AdminDroid

Get Group Audit Report in Microsoft 365

Important Tips

Monitor Microsoft 365 group creations to identify and delete unwanted groups, ensuring that only relevant groups remain in your organization.

Apply retention policies to Microsoft 365 groups to ensure that content is retained in the Preservation Hold Library of SharePoint Online and OneDrive, even after the group is deleted.

Audit Microsoft 365 file deletions when a group is deleted to check whether any critical file has been removed from the SharePoint Online.

Common Errors and Resolution Steps

Error Get-MgDirectoryDeletedItemAsGroup : Insufficient privileges to complete the operation. Status: 403 (Forbidden) ErrorCode: Authorization_RequestDenied

Error Restore-MgBetaDirectoryDeletedItem : Invalid object identifier '4765-543587-5454-4522'. Status: 400 (BadRequest) ErrorCode: Request_BadRequest

Error Write-ErrorMessage : Cannot process argument transformation on parameter 'EndDate'. Cannot convert value "31/10/2024" to type "Microsoft.Exchange.ExchangeSystem.ExDateTime".

Error Failed to restore group. Insufficient privileges to restore some or all of the selected groups.

Frequently Asked Questions

Promptly Recover Deleted Microsoft 365 Groups to Prevent Data Loss!

What happens when you delete a Microsoft 365 group?

How to see who deleted a Microsoft 365 group?

Steps to find who deleted a M365 group using Microsoft Purview portal

Steps to find who deleted a M365 group using Exchange Online PowerShell

How to restore a deleted Microsoft 365 group?

Steps to recover a deleted Microsoft 365 group in the Microsoft Entra admin center

Steps to retrieve a deleted Microsoft 365 group using Microsoft Graph PowerShell

Can admins retain Microsoft 365 groups resources for a specific period?

Kickstart Your Journey With AdminDroid

Using AdminDroid
Simple & Quick

Kickstart Your Journey With
AdminDroid