How to Detect When a Microsoft Teams Team Is Deleted
Question details
The user needs to find out exactly when a Microsoft Teams team is deleted and identify the user who deleted it, as the standard deleted-group alerts are too broad.
- Product
- Microsoft Teams
- Device & OS
- not provided
- Scenario
- Monitoring administrative activities to track specific Microsoft Teams team deletions instead of general Microsoft 365 group deletions.
- Observed behavior
- Standard Microsoft 365 'deleted-group' alerts trigger for multiple group types (like distribution or security groups) without clearly identifying if a specific Teams team was deleted.
Ensure you have the necessary administrator permissions (such as Global Admin or Compliance Admin) to access Microsoft Purview and perform audit log searches in your Microsoft 365 tenant.
Use Microsoft Purview Audit to Search for Deleted Teams
Search the unified audit log specifically for the 'Deleted team' activity to accurately identify the deleted team and the user responsible.
Because the general 'Deleted group' activity logs apply to all Microsoft 365 groups, distribution lists, and security groups, filtering specifically for the 'Deleted team' activity provides the exact results you need.
Log in to the Microsoft Purview compliance portal using your administrator credentials.
Select 'Audit' from the left-hand navigation menu to open the audit log search tool.
Configure the 'Start date' and 'End date' fields to cover the timeframe when you suspect the deletion occurred.
Click on the 'Activities' dropdown menu, type 'Deleted team' in the search bar, and select it to filter out general group deletions.
Click the 'Search' button. Once the results load, click on individual records to view the detailed team name and the account of the user who deleted it.
Automate Deleted Team Notifications with Power Automate
Since there is no dedicated built-in alert policy for deleted Teams, you can build a custom flow in Power Automate for monitoring and notifications.
Manage Your Documents Effectively with WPS Office
While you manage your Microsoft Teams environment and administrative audits, you can use WPS Office as a free, lightweight, and highly compatible alternative for creating and editing your daily reports and office documents.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install WPS Office: Run the downloaded installer file and follow the quick on-screen instructions to set up the software.
- 3. Open and Edit: Launch WPS Office and directly open your existing Microsoft Office files (.docx, .xlsx, .pptx) without any format loss.
Frequently Asked Questions
Why does the standard 'Deleted group' alert not specify if it was a Microsoft Teams team?
The 'Deleted group' activity in Microsoft 365 covers various types of groups, including standard Microsoft 365 groups, distribution lists, and security groups. Because every Microsoft Team is backed by a Microsoft 365 group, the standard alert is triggered but remains too broad to explicitly indicate that a Team interface was attached and deleted.
Can I recover a Microsoft Teams team after it has been deleted?
Yes. When a Microsoft Teams team is deleted, the underlying Microsoft 365 group is soft-deleted. An administrator can typically restore this group within 30 days via the Microsoft 365 admin center or Azure Active Directory, which will also restore the associated Team, its channels, and files.
Is there a default alert policy specifically for deleted Teams in Microsoft 365?
No, Microsoft 365 currently does not provide a dedicated, built-in alert policy that strictly monitors deleted Teams. Administrators must manually search the Purview Audit logs for the 'Deleted team' activity or create a custom automation workflow using Power Automate.
