Permission & Access Issues

How to Find Who Created a SharePoint Online Group

Nimra Malik Oct 21, 2026 869 views

Question details

Administrators need to identify the specific user who created a permission group within a SharePoint Online site.

Product: SharePoint Online
Device & OS: not provided
Scenario: Reviewing site security configurations and auditing user activities related to permission management.
Observed behavior: Finding the original creator of a SharePoint group to maintain compliance and proper access control.

Before you start

Ensure you have administrator credentials to access the Microsoft Purview compliance portal, and verify that audit logging was actively enabled on your tenant before the group was created.

Solution 1Recommended

Search the Audit Log in Microsoft Purview

Use the Microsoft Purview compliance portal to trace the 'Created group' event and identify the user responsible.

SharePoint does not display the group creator directly in the site permissions interface. Instead, you must query the unified audit log to find the exact timestamp and user account associated with the group creation event.

Access Microsoft Purview

Log in to the Microsoft Purview compliance portal (compliance.microsoft.com) using your global admin or compliance admin credentials.

Navigate to the Audit Tool

In the left-hand navigation pane, scroll down and click on 'Audit' to open the audit log search interface.

Set the Date Range

Configure the 'Start date' and 'End date' fields to cover the timeframe when you suspect the SharePoint group was created.

Select the Activity

Click the 'Activities' dropdown menu, scroll to 'Site permissions activities', and check the box next to 'Created group'.

Run Search and Review

Click the 'Search' button. Once the results load, locate the group name in the list and look at the 'User' column to see who initiated the creation.

Search the Audit Log in Microsoft Purview

Prerequisite Role: To create a SharePoint group in the first place, a user generally must have 'Manage Permissions' rights or be assigned the 'Site Owner' role.

Free Microsoft Office alternative

Manage Your Documents with WPS Office

While managing SharePoint permissions requires Microsoft admin tools, creating and editing the actual documents stored in those sites doesn't have to be expensive. WPS Office is a highly compatible, free alternative to Microsoft Office that lets you handle your Word, Excel, and PowerPoint files with ease.

1. Download the Installer: Visit the official WPS Office website to download the free installation package for your operating system.
2. Install WPS Office: Run the downloaded file and follow the quick on-screen instructions to install the software.
3. Open Office Files: Launch WPS Office to immediately open, edit, and save your existing Microsoft Office documents without any formatting loss.

Completely free and lightweight office suite for daily tasks.Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx).Familiar user interface requires no learning curve.Includes a robust built-in PDF editor for comprehensive document management.

microsoft office alternative - wps office

Frequently Asked Questions

Who has the default permission to create a SharePoint group?

By default, only users who are assigned the 'Site Owner' role or have custom permission levels that include 'Manage Permissions' rights are authorized to create new SharePoint groups.

Why is the 'Created group' event missing from my audit log search?

If the event does not appear, it is usually because audit logging was not enabled for your Microsoft 365 tenant at the time the group was created, or the creation date falls outside of your selected search range.

Can I use PowerShell to find who created a SharePoint group?

While PowerShell can manage and list SharePoint groups, identifying the original creator still relies on querying the unified audit log. You can use the 'Search-UnifiedAuditLog' cmdlet in Exchange Online PowerShell to search for the 'CreatedGroup' operation.

Document & File Issues