Created by Claude - please verify

Group sprawl - Microsoft 365 groups created in the last 12 months, including deleted ones still in the 30-day recycle bin. Creators come from the 30-day directory audit.

Required Microsoft Graph permissions

Group.Read.All AuditLog.Read.All (creators - optional) — application permissions, granted to the app registration with admin consent.

Endpoints: GET /v1.0/groups?$filter=groupTypes/any(c:c eq 'Unified')&$expand=owners / members · GET /v1.0/directory/deletedItems/microsoft.graph.group · GET /v1.0/auditLogs/directoryAudits?$filter=activityDisplayName eq 'Add group'

Deleted groups leave the recycle bin after 30 days, so 'deleted after N days' only counts groups deleted in the last month. 'Members' is capped at 20 by Graph's $expand - 20+ means 20 or more.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Group & Teams Sprawl Trend

How fast are new teams and groups appearing, who creates them, and how many are abandoned - deleted again within weeks, never given a member, or left without an owner? A steady stream of short-lived groups points at a self-service creation policy that needs a naming, approval or expiration rule.

No Microsoft 365 group was created in the last 12 months.