DEV Community: Priya Santos

Finding Microsoft Teams with No Owner (or Only One) Using PowerShell

Priya Santos — Fri, 16 Oct 2026 13:08:46 +0000

Every Microsoft 365 tenant I audit has at least one team that nobody owns. The person who created it left, or moved roles, and the team carries on with files, chats and guest access but no one who can manage membership or answer the question "should this still exist?"

A team with a single owner is the same problem waiting to happen. If that person is off sick, on holiday or leaves, nobody can add a new starter, remove a departing contractor or archive the team when the project ends.

This post walks through a short PowerShell script that lists every team with its owner count, so you can spot the gaps and fix them in one sitting.

What you need

You need the MicrosoftTeams PowerShell module and an account with the Teams Administrator or Global Administrator role. Install the module once:

Install-Module MicrosoftTeams -Scope CurrentUser

Then connect:

Connect-MicrosoftTeams

You will be prompted to sign in. If your admin account uses multifactor authentication, which it should, the normal sign-in prompt handles that.

The report script

The script loops through every team, counts owners, members and guests, and builds a simple object for each one:

$report = foreach ($team in Get-Team) {
    $users  = Get-TeamUser -GroupId $team.GroupId
    $owners = $users | Where-Object Role -eq 'Owner'

    [PSCustomObject]@{
        Team        = $team.DisplayName
        Visibility  = $team.Visibility
        Archived    = $team.Archived
        OwnerCount  = @($owners).Count
        MemberCount = @($users | Where-Object Role -eq 'Member').Count
        GuestCount  = @($users | Where-Object Role -eq 'Guest').Count
        Owners      = ($owners.User -join '; ')
        GroupId     = $team.GroupId
    }
}

A few details worth explaining:

Get-TeamUser returns everyone in the team with a Role of Owner, Member or Guest, so one call per team gives all three counts.
Wrapping results in @() makes sure .Count works even when there is only one owner or none at all.
GroupId is kept in the output because you will need it to fix anything the report finds.

Reading the results

Sort by owner count so the problems rise to the top:

$report | Sort-Object OwnerCount | Format-Table Team, OwnerCount, MemberCount, GuestCount, Archived -AutoSize

Then save a copy for your records:

$report | Export-Csv -Path .\TeamsOwnerReport.csv -NoTypeInformation

When I run this for a small firm, the output usually falls into three groups:

Teams with zero owners. These need attention first, especially if the guest count is above zero.
Teams with one owner. These are fine today but fragile. Most should have a second owner.
Archived teams. These can often be left alone, but check whether they still need to exist at all.

If you only want the risky ones, filter the report:

$report | Where-Object { $_.OwnerCount -lt 2 -and -not $_.Archived }

Fixing the gaps

Adding an owner takes one line. The user must be in your tenant, and if they are not already a member, this adds them and promotes them in one step:

Add-TeamUser -GroupId "GROUP-ID-FROM-REPORT" -User "NEW-OWNER-UPN" -Role Owner

For teams that are clearly finished, archiving is usually better than deleting. It keeps the content readable while stopping new activity:

Set-TeamArchivedState -GroupId "GROUP-ID-FROM-REPORT" -Archived $true

Before deleting anything, talk to whoever used the team last. Files in a forgotten team are sometimes the only copy of something a client or regulator might ask for later.

Running it on a schedule

The report takes a few minutes in a small tenant, so it is easy to run monthly. I keep the script in a shared admin folder and add the date to the export file name:

$stamp = Get-Date -Format 'yyyy-MM-dd'
$report | Export-Csv -Path ".\TeamsOwnerReport-$stamp.csv" -NoTypeInformation

Comparing two months side by side makes it obvious when a new ownerless team appears, usually straight after someone leaves.

Wrapping up

Ownerless teams are not dramatic, but they are a quiet governance gap: nobody reviews the members, nobody removes guests and nobody decides when the team should end. A short script and a monthly habit of running it close that gap for very little effort.

A simple rule that works well in small businesses: every team has at least two owners, and at least one of them is a manager rather than whoever happened to click "Create team".

Finding Inactive Microsoft 365 Users with PowerShell and Microsoft Graph

Priya Santos — Tue, 06 Oct 2026 11:18:30 +0000

Every Microsoft 365 tenant collects accounts nobody uses anymore. A contractor finishes a project, a temp leaves after a busy season, or someone sets up a test account and forgets it exists.

Each of those accounts is a problem twice over. It is a security risk, because an account nobody watches is an ideal target for a password spray or phishing attack. It is often a cost too, because many of them still hold a paid licence.

The Microsoft 365 admin centre shows sign-in activity one user at a time, but that does not scale. Here is a PowerShell script that finds every inactive account in one pass using the Microsoft Graph PowerShell SDK.

What you need before you start

The script relies on the signInActivity property in Microsoft Graph, which comes with a few requirements:

Microsoft Graph PowerShell SDK installed on your machine
Microsoft Entra ID P1 or P2 in the tenant, because sign-in activity is not available on free tenants (Microsoft 365 Business Premium includes P1)
Permissions: User.Read.All and AuditLog.Read.All, which need admin consent the first time you connect

If the SDK is not installed yet:

Install-Module Microsoft.Graph -Scope CurrentUser

The script

# Connect with the permissions needed to read users and sign-in activity
Connect-MgGraph -Scopes "User.Read.All", "AuditLog.Read.All"

# Anyone who has not signed in within this many days is flagged
$daysInactive = 90
$cutoff = (Get-Date).AddDays(-$daysInactive)

# Pull every user with the properties we need
$users = Get-MgUser -All -Property Id, DisplayName, UserPrincipalName, UserType, AccountEnabled, CreatedDateTime, AssignedLicenses, SignInActivity |
    Where-Object { $_.UserType -eq 'Member' }

$report = foreach ($user in $users) {

    # Take the most recent of interactive and non-interactive sign-ins
    $lastSignIn = @(
        $user.SignInActivity.LastSignInDateTime,
        $user.SignInActivity.LastNonInteractiveSignInDateTime
    ) | Where-Object { $_ } | Sort-Object -Descending | Select-Object -First 1

    # Skip accounts created recently that may not have signed in yet
    if ($user.CreatedDateTime -gt $cutoff) { continue }

    if (-not $lastSignIn -or $lastSignIn -lt $cutoff) {
        [PSCustomObject]@{
            DisplayName       = $user.DisplayName
            UserPrincipalName = $user.UserPrincipalName
            AccountEnabled    = $user.AccountEnabled
            Licensed          = $user.AssignedLicenses.Count -gt 0
            Created           = $user.CreatedDateTime
            LastSignIn        = $lastSignIn
        }
    }
}

# Save the results and show a quick summary
$report | Sort-Object LastSignIn | Export-Csv -Path .\InactiveUsers.csv -NoTypeInformation

Write-Host "Inactive accounts found: $($report.Count)"
Write-Host "Of which still licensed: $(($report | Where-Object Licensed).Count)"

Disconnect-MgGraph

How the script works

The script connects to Microsoft Graph, pulls every member account along with its sign-in activity, and flags anyone whose most recent sign-in is older than the cutoff. It also flags accounts that have never signed in, unless they were created within the cutoff period and are simply new.

A few details are worth understanding.

Why check non-interactive sign-ins as well?

LastSignInDateTime only records interactive sign-ins, where a person types a password or approves an MFA prompt. Someone who stays signed in to Outlook on their phone may not have an interactive sign-in for weeks, even though they use their account daily. Checking LastNonInteractiveSignInDateTime also prevents active users from being flagged by mistake.

Why exclude guests?

Guest accounts behave differently and are usually reviewed separately, so the script only looks at members. If you want guests included, remove the Where-Object filter on UserType.

Why the licence column matters

The Licensed column is where the quick wins are. An inactive account with no licence is mainly a security clean-up. An inactive account that still holds a Business Premium licence is costing money every month.

What to do with the results

Resist the temptation to delete everything on the list straight away. A safer sequence looks like this:

Check with managers. Some accounts are used for occasional tasks, or belong to people on long-term leave.
Block sign-in first. Disabling the account stops any risk immediately and is easy to reverse if someone turns out to need it.
Keep mailboxes you still need. If a departed user's mailbox holds important history, converting it to a shared mailbox keeps the data accessible, and shared mailboxes up to 50 GB do not need a licence.
Remove licences. Once the account is blocked and any data is preserved, free up the licence.
Delete after a waiting period. Many teams wait 30 days after blocking before deleting, in case anything unexpected comes up.

Things to watch out for

Service accounts. Accounts used by scanners, printers or line-of-business applications may sign in rarely or in unusual ways. Label them clearly so they are not caught in a clean-up.

Data delays. Sign-in activity can take a few hours to update, so a user who signed in this morning may not show it yet. This does not matter for a 90-day check, but keep it in mind if you shorten the window.

Run it regularly. A one-off clean-up helps, but accounts start piling up again straight away. Running the script monthly, or scheduling it with Azure Automation, keeps the tenant tidy with very little effort.

Wrapping up

Inactive accounts are one of the easiest security and cost problems to fix in Microsoft 365, and one of the easiest to forget about. Half an hour with this script usually turns up a few surprises, and often a few licences you can stop paying for.

If you adapt the script, for example, to include guests or send the report by email, I would be interested to hear how you approached it in the comments.