Find inactive Microsoft Teams with Azure Automation and GraphAPI

In many projects I get the question about how to find inactive Microsoft Teams and how to deal with them. In this blog post, I show you how to find inactive Microsoft Teams with Azure Automation and GraphAPI. The script adds all inactive Teams or Microsoft 365 to a SharePoint Online list. In a second blog post, I will describe how to archive these inactive groups. Of course, Microsoft offers a built-in solution for these scenarios. But perhaps the solution doesn’t fit to 100% to your business needs and then an own solution comes into the game.

---

Microsoft’s way to find inactive Teams

Microsoft has a built-in solution finding inactive Teams: Microsoft 365 Group expiration. To use this feature, you need at least the Azure Premium license in your tenant. If you have that luck, then you can define a policy and the system will check the activity for each M365 group. If the algorithm detects an inactive group, it will send a mail to the owner and asks to delete the M365 group. Also, you can enable an auto-renew feature and groups renew automatically based on their activity.

One of the biggest disadvantages: the process just deletes the expired group. There is no option to archive an inactive Microsoft 365 group.

The second disadvantage: you can enable this feature for all groups or select some. An option to exclude some groups and apply the policy to all other is missing.

---

Build your own solution

As mentioned in the intro, you can build your own lifecycle management process for Microsoft 365 groups. It will find inactive Microsoft Teams with Azure Automation and GraphAPI. All you need, is a script to detect the group activity and based on this, decide if a group is active or inactive. And then, it depends on your needs, what happens with an inactive group:

• notify by mail the Teams Service team
• ask the owner how to continue with the inactive Team
• archive the Team
• delete the Team
• just report

As you can see, there are a lot of options thanks to the Microsoft 365 and Azure platform.

In this blog post series, I will describe the way to notify and ask the Teams owner if the Team should be archived or not. I’m using the following tools to archive this:

• Microsoft Azure Automation with Managed Identity
• Microsoft GraphAPI
• Microsoft Power Automate

In the first part, I describe how to get the required data to find inactive M365 groups. In part two, I describe how to start an approval process to archive a Teams and in the last part, you will get the information how to archive the Teams.

---

Create a SharePoint list to store inactive Microsoft365 groups

As in my other blog post, I’m using a SharePoint Online list to store the inactive M365 groups. Why I’m using SharePoint Online List:

First, all organizations have a SharePoint Online license. Second, it is really easy to setup and manage. Of course, you can store the data in Dataverse for example and adjust the script, too.

The SharePoint Online list to store the inactive M365 groups should include the following columns:

• Report Refresh Date
• Report Period
• Group Id
• Group Display Name
• Group Owners
• Group Type
• Is Deleted
• Last Activity Date
• Member Count
• External Member Count
• Exchange Received Email Count
• Exchange Mailbox Total Item Count
• Exchange Mailbox Storage Used Byte
• SharePoint Active Files Count
• SharePoint Site Storage Used by Byte
• Should Be Archived
• Approved to Archive
• Approved By
• Is Archived

You can find a PowerShell script in my GitHub repository to create the required list. Managed Identity mode is not used because it only needs to be run once and you can use your SharePoint Admin account for it.

Create an Azure Automation account

Next, you need to create an Azure Automation Account and use it as Managed Identity. The Managed Identity will run all required PowerShell scripts to find inactive Microsoft 365 groups and add it to the SharePoint Online list.

By default, the wizard creates a System Managed identity.

In the next step, you need to grant required permissions to the newly Managed Identity, so it has access to the automation account and can run your script.

Also, it needs permissions to gather the Microsoft 365 group reports. Currently, you need to assign all these permissions by PowerShell and you can find the script in my GitHub.

Then, you need to prepare the Azure Automation environment and add the required PowerShell modules. The following modules are required to run the scripts:

• PnP.PowerShell
• Microsoft.Graph.Authentication
• Microsoft.Graph.Reports

It is important to use the PowerShell version 7.2 environment in Azure.

You can add them by using the Browse from gallery option, search for the modules and select 7.2 (preview) as Runtime version. Press the Import button at the bottom to start the Import process of the PowerShell module.

When you have imported all modules, it is time to import my scripts to find inactive Teams. You can find the script in my GitHub repository, as all other script snippets for the permissions, too.

After you’ve imported and published all scripts, you can run it for the first time.

---

How to find inactive Teams with Microsoft GraphAPI

When you start the script, it uses the Microsoft GraphAPI to get M365 group activity report and finds inactive groups. The Microsoft 365 group activity report includes all necessary data for this job:

• Report Refresh Date
• Group Display Name
• Is Deleted
• Owner Principal Name
• Last Activity Date
• Group Id
• Report Period

The endpoint provides the data as CSV file. In the next step, a script imports the CSV file, and analysed the records regarding the last activity date.

If there were never ever any activities in the M365 group, the last activity date for a M365 group is empty and we can assume that the M365 group is inactive. Therefor the script adds the dataset to a SharePoint Online list as “to archive”.

If the imported data record includes a last activity date, the script checks if it is older than 30 days. Of course, you can modify this value. If it is older than 30 days, the script assumes an inactive M365 group and adds the dataset to the SharePoint Online list.

If the M365 group is already deleted or active, the script skips the dataset.

You can find the script “How to find inactive Teams” in my GitHub repository.

After writing the data to the SharePoint Online list, you can start a Power Automate flow or use some other fantastic Microsoft 365 tools to process the generated data.

---

Links

Microsoft 365 group expiration

Microsoft 365 groups activity reports

How to find ownerless Microsoft Teams – Part 2