Identifying the creator of an Microsoft Team (Who created this Team)

This really sounds like its available out of the box right there in the group’s metadata column, apparently its not. You can see who the current admin is, but not the original creator (although usually that is probably the same). In PowerShell there is a property for “Created On” but no “Created By“.

In my case, I had to find out the creator of a specific Microsoft Team but Teams didn’t have the metadata of the Creator so the only way to find out seemed by tracing the Office 365 Audit Logs.

Office 365 Audit Logs can get you plenty of information which you can’t observe directly from the workload UI or PowerShell.

First and foremost, in order to extract the logging details, Audit Log capability must be running in your tenant.

Use this command via PowerShell to enable it if you haven’t. And, after enabling you must wait for a while to allow the logs analytics component to record the logs (won’t be available immediately)

Connect-ExchangeOnline
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

Detailed information of enabling/disabling Auditing in Office 365 is right here – https://docs.microsoft.com/en-us/microsoft-365/compliance/turn-audit-log-search-on-or-off?view=o365-worldwide

Searching for activities (Teams Creation in this case)

Head on to protection.office.com and navigate Search –> Audit Log Search

“Created Team” log activity is available under Microsoft Teams category in the Audit Log. You can simply type “Teams” to get the category and choose the event type underneath it.