Audit Microsoft 365 Group Related Events Using Graph PowerShell

Microsoft 365 Groups play a key role in collaboration—connecting users across Teams, SharePoint, Outlook, and more. As administrators, it’s critical to track changes related to these groups: who created them, who deleted them, who added members or owners. Graph PowerShell provides the tools to fetch these events from Entra ID (Azure AD) audit logs in a precise and automated manner.

Why Audit Microsoft 365 Group Related Events Using Graph PowerShell?

Auditing helps ensure accountability and governance across your Microsoft 365 environment. With Graph PowerShell, you can:

• Track who performed group-related actions (via admin UPN)
• Identify when an event occurred (creation, deletion, etc.)
• Automate daily or weekly audits to maintain compliance

Whether you’re tracking unwanted deletions or monitoring group provisioning, these scripts can give you a clear audit trail.

How to Audit Microsoft 365 Group Related Events Using Graph PowerShell

Each of the below scripts uses Microsoft Graph PowerShell to query the Entra ID audit logs, capturing both event timestamps and actor identities. These details are essential for audits and security reviews.

• Audit Microsoft 365 Group Creations

This script fetches all newly created Microsoft 365 Groups from Entra ID audit logs. It shows when each group was created and which admin or service principal created it.

👉 Learn how to audit M365 Group creations using Graph PowerShell

• Audit Microsoft 365 Group Deletions

Worried about accidental or unauthorized group deletions? This script helps you track when groups were deleted and by whom—providing crucial data for recovery or escalation.

👉 Learn how to audit deleted M365 Groups using Graph PowerShell

• Audit Microsoft 365 Group Member Additions

Stay on top of group membership changes. This script identifies who added new members to a Microsoft 365 group and when it happened, ensuring transparency and control.

👉 Learn how to track group member additions using Graph PowerShell

• Audit Microsoft 365 Group Owner Additions

Owner permissions are powerful. This script shows who granted ownership of a group and when—helping you ensure that elevated privileges are correctly assigned.

👉 Learn how to audit group owner additions using Graph PowerShell

Conclusion

Auditing Microsoft 365 group activities is not just a security best practice—it’s essential for compliance, accountability, and efficient governance. Using Graph PowerShell and the right scripts, you can automate these audits and stay informed about critical group-level changes in your tenant.

Explore the above guides from M365Corner to get started and tailor the scripts to your specific needs!