Entra / Microsoft 365 · Teams
Report archived teams
Script to show how to report Teams archiving actions extracted from the Office 365 audit log.
Connect & set up
Run these once per session. All scopes are read-only unless the script makes changes.
Connect-ExchangeOnline -ShowBanner:$falseConnect-MicrosoftTeams
Run it
The main script. Copy it, or download the .ps1 and run it from your console.
param([int] $LookbackDays = 90,[string] $StartDate = (Get-Date).AddDays(-$LookbackDays); $EndDate = (Get-Date),[string] $EndDate = (Get-Date))$ModulesLoaded = Get-Module | Select NameIf (!($ModulesLoaded -match "ExchangeOnlineManagement")) {Write-Host "Please connect to the Exchange Online Management module and then restart the script"; break}If (!($ModulesLoaded -match "MicrosoftTeams")) {Write-Host "Please connect to the Microsoft Teams module and then restart the script"; break}# Some lines to create the c:\temp\ directory. Comment them out if you don't want this to happen$Path = "C:\Temp"If(!(test-path $path)) {New-Item -ItemType Directory -Force -Path $path | Out-Null }# Define output CSV file$OutputCsvFile = "c:\temp\TeamsArchiveAuditRecords.csv"CLS; Write-Host "Searching Audit Records to find Teams archiving operations"[array]$Records = (Search-UnifiedAuditLog -Operations TeamSettingChanged -StartDate $StartDate -EndDate $EndDate -ResultSize 5000)If ($Records.Count -eq 0) {Write-Host "No audit records for team archiving found." }Else {Write-Host "Processing" $Records.Count "team archiving audit records..."$Report = [System.Collections.Generic.List[Object]]::new() # Create output fileForEach ($Rec in $Records) {$AuditData = ConvertFrom-Json $Rec.AuditdataIf ($AuditData.Name -eq "Team is archived") { # It's an archival team setting recordSwitch ($AuditData.NewValue) {"False" { $Action = "Restored team" }"True" { $Action = "Archived team" }} #end switchWrite-Host "Checking channels for" $AuditData.TeamName$TeamId = (Get-Team -DisplayName $AuditData.TeamName).GroupIdIf ($TeamId) {[array]$TeamChannels = Get-TeamChannel -GroupId $TeamId[array]$StandardChannels = $TeamChannels | ? {$_.Membershiptype -eq "Standard"}[array]$SharedChannels = $TeamChannels | ? {$_.Membershiptype -eq "Shared"}[array]$PrivateChannels = $TeamChannels | ? {$_.Membershiptype -eq "Private"}$ChannelStatus = "OK" }Else {$ChannelStatus = "Team might be deleted" }$ReportLine = [PSCustomObject] @{TimeStamp = Get-Date($AuditData.CreationTime) -format gUser = $AuditData.UserIdTeam = $AuditData.TeamNameAction = $ActionChannels = $TeamChannels.CountRegular = $StandardChannels.CountPrivate = $PrivateChannels.CountShared = $SharedChannels.CountStatus = $ChannelStatus}$Report.Add($ReportLine)} #end if} #end foreach} #end else$Report | Out-GridView$Report | Export-CSV -NoTypeInformation $OutputCsvFileWrite-Host ("All done. {0} audit events output to {1}" -f $Report.Count, $OutputCsvFile)
Parameters
ParameterDefaultNotes
-LookbackDays90Number of days back to search the unified audit log.-StartDate(Get-Date).AddDays(-90); $EndDate = (Get-Date)Start of the reporting window.-EndDate(Get-Date)End of the reporting window.Attribution
Author
Office365itpros