Back to script library
Entra / Microsoft 365 · Teams

Report archived teams

Script to show how to report Teams archiving actions extracted from the Office 365 audit log.

Connect & set up

Run these once per session. All scopes are read-only unless the script makes changes.

Connect-ExchangeOnline -ShowBanner:$false
Connect-MicrosoftTeams

Run it

The main script. Copy it, or download the .ps1 and run it from your console.

param(
[int] $LookbackDays = 90,
[string] $StartDate = (Get-Date).AddDays(-$LookbackDays); $EndDate = (Get-Date),
[string] $EndDate = (Get-Date)
)
$ModulesLoaded = Get-Module | Select Name
If (!($ModulesLoaded -match "ExchangeOnlineManagement")) {Write-Host "Please connect to the Exchange Online Management module and then restart the script"; break}
If (!($ModulesLoaded -match "MicrosoftTeams")) {Write-Host "Please connect to the Microsoft Teams module and then restart the script"; break}
# Some lines to create the c:\temp\ directory. Comment them out if you don't want this to happen
$Path = "C:\Temp"
If(!(test-path $path)) {
New-Item -ItemType Directory -Force -Path $path | Out-Null }
# Define output CSV file
$OutputCsvFile = "c:\temp\TeamsArchiveAuditRecords.csv"
CLS; Write-Host "Searching Audit Records to find Teams archiving operations"
[array]$Records = (Search-UnifiedAuditLog -Operations TeamSettingChanged -StartDate $StartDate -EndDate $EndDate -ResultSize 5000)
If ($Records.Count -eq 0) {
Write-Host "No audit records for team archiving found." }
Else {
Write-Host "Processing" $Records.Count "team archiving audit records..."
$Report = [System.Collections.Generic.List[Object]]::new() # Create output file
ForEach ($Rec in $Records) {
$AuditData = ConvertFrom-Json $Rec.Auditdata
If ($AuditData.Name -eq "Team is archived") { # It's an archival team setting record
Switch ($AuditData.NewValue) {
"False" { $Action = "Restored team" }
"True" { $Action = "Archived team" }
} #end switch
Write-Host "Checking channels for" $AuditData.TeamName
$TeamId = (Get-Team -DisplayName $AuditData.TeamName).GroupId
If ($TeamId) {
[array]$TeamChannels = Get-TeamChannel -GroupId $TeamId
[array]$StandardChannels = $TeamChannels | ? {$_.Membershiptype -eq "Standard"}
[array]$SharedChannels = $TeamChannels | ? {$_.Membershiptype -eq "Shared"}
[array]$PrivateChannels = $TeamChannels | ? {$_.Membershiptype -eq "Private"}
$ChannelStatus = "OK" }
Else {
$ChannelStatus = "Team might be deleted" }
$ReportLine = [PSCustomObject] @{
TimeStamp = Get-Date($AuditData.CreationTime) -format g
User = $AuditData.UserId
Team = $AuditData.TeamName
Action = $Action
Channels = $TeamChannels.Count
Regular = $StandardChannels.Count
Private = $PrivateChannels.Count
Shared = $SharedChannels.Count
Status = $ChannelStatus
}
$Report.Add($ReportLine)
} #end if
} #end foreach
} #end else
$Report | Out-GridView
$Report | Export-CSV -NoTypeInformation $OutputCsvFile
Write-Host ("All done. {0} audit events output to {1}" -f $Report.Count, $OutputCsvFile)

Parameters

ParameterDefaultNotes
-LookbackDays90Number of days back to search the unified audit log.
-StartDate(Get-Date).AddDays(-90); $EndDate = (Get-Date)Start of the reporting window.
-EndDate(Get-Date)End of the reporting window.
Attribution