Microsoft 365 Groups are the foundation of collaboration across Microsoft 365. Whether users create a Team in Microsoft Teams, collaborate through Outlook, use Planner, or share files in SharePoint Online, a Microsoft 365 Group is often created behind the scenes. Every group should have at least one owner who manages membership, updates settings, and ensures the group remains secure and organized.
However, groups don’t always keep their owners forever. When an employee leaves the organization, changes roles, or their account is deleted without transferring ownership, the group can become ownerless. Although members can often continue using the group, nobody is left to manage it. Over time, this can lead to governance issues, outdated memberships, and unnecessary security risks.
Let’s learn how to identify ownerless groups and to configure Microsoft’s built-in Ownerless Group Policy.
Why Finding Ownerless Groups Is Important
Ownerless groups may continue functioning, but they introduce several administrative and security challenges. For example, if new employees need access to a Team, there may be nobody available to approve their request. Likewise, users who no longer need access may remain members because nobody is responsible for reviewing permissions.
Ownerless groups can also affect governance initiatives. Many organizations rely on group owners to review memberships, archive inactive workspaces, or comply with internal policies. Without an owner, these tasks are often overlooked.
Regularly reviewing ownerless groups helps administrators:
- Maintain proper ownership across collaboration workspaces.
- Keep memberships up to date.
- Reduce unnecessary access.
- Support governance and compliance requirements.
- Ensure every Microsoft 365 Group has someone responsible for managing it.
Find Ownerless Groups in Microsoft 365 Admin Center
Follow the below mentioned steps to identify the ownerless groups in Microsoft 365 environment.
- Open the Microsoft 365 admin center.
- Go to Teams & groups → Active teams & groups.
- Select Filter → Ownerless groups.
Open an affected group. - On the Membership tab, select Owners, then Add.
Choose an appropriate replacement owner and confirm the change.
Find Ownerless Groups in Microsoft 365 Using PowerShell
PowerShell helps administrators review group ownership across the tenant and export the results for follow-up. To cover different group types accurately, this method combines Microsoft Graph PowerShell with Exchange Online PowerShell.
Microsoft Graph retrieves ownership information for cloud-managed Microsoft 365 Groups and non-mail-enabled security groups. However, it does not expose ownership for distribution groups and Exchange-created mail-enabled security groups. Treating an empty response as proof of missing ownership can incorrectly classify these groups as ownerless.
Exchange Online PowerShell provides ownership information for distribution groups, mail-enabled security groups, and dynamic distribution groups. Combining both modules allows these groups to appear in the same report.
Prerequisites
Before running the script, ensure the following requirements are met.
- Install Microsoft.Graph.Groups and ExchangeOnlineManagement.
- Use an account with permission to read group information in Microsoft Graph and run the required Exchange Online commands.
- Grant administrator consent for the Group.Read.All Microsoft Graph permission.
The script below checks Microsoft 365 Groups and cloud security groups through Microsoft Graph. It checks distribution groups, mail-enabled security groups, and dynamic distribution groups through Exchange Online, using the ManagedBy property to identify missing owners.
# Install the required modules once, if needed:
# Install-Module Microsoft.Graph.Groups -Scope CurrentUser
# Install-Module ExchangeOnlineManagement -Scope CurrentUser -Force
$ErrorActionPreference = "Stop"
Import-Module Microsoft.Graph.Groups
Import-Module ExchangeOnlineManagement
# Connect to both services
Connect-MgGraph -Scopes "Group.Read.All"
Connect-ExchangeOnline -DisableWAM -ErrorAction Stop
# Confirm Exchange commands are available before proceeding
Get-Command Get-DistributionGroup, Get-DynamicDistributionGroup `
-ErrorAction Stop | Out-Null
# Fetch all data before building the report
Write-Host "Fetching Microsoft Graph groups..." -ForegroundColor Cyan
$GraphGroups = Get-MgGroup -All `
-Property Id,DisplayName,Mail,GroupTypes,MailEnabled,SecurityEnabled,OnPremisesSyncEnabled `
-ErrorAction Stop
Write-Host "Fetching distribution and mail-enabled security groups..." `
-ForegroundColor Cyan
$ExchangeGroups = Get-DistributionGroup -ResultSize Unlimited `
-ErrorAction Stop
Write-Host "Fetching dynamic distribution groups..." -ForegroundColor Cyan
$DynamicGroups = Get-DynamicDistributionGroup -ResultSize Unlimited `
-ErrorAction Stop
$FailedChecks = [System.Collections.Generic.List[string]]::new()
$SkippedSyncedGroups = 0
$OwnerlessGroups = @(
# Microsoft 365 Groups and non-mail-enabled security groups
foreach ($Group in $GraphGroups) {
$IsMicrosoft365 = $Group.GroupTypes -contains "Unified"
$IsSecurity = $Group.SecurityEnabled -and -not $Group.MailEnabled
if (-not ($IsMicrosoft365 -or $IsSecurity)) {
continue
}
if ($Group.OnPremisesSyncEnabled -eq $true) {
$SkippedSyncedGroups++
continue
}
try {
$Owners = @(
Get-MgGroupOwner -GroupId $Group.Id -All -ErrorAction Stop
)
if ($Owners.Count -eq 0) {
[PSCustomObject]@{
GroupId = $Group.Id
DisplayName = $Group.DisplayName
EmailAddress = $Group.Mail
GroupType = if ($IsMicrosoft365) {
"Microsoft 365 group"
} else {
"Security group"
}
MembershipType = if (
$Group.GroupTypes -contains "DynamicMembership"
) {
"Dynamic"
} else {
"Assigned"
}
OwnershipSource = "Microsoft Graph"
}
}
}
catch {
$FailedChecks.Add($Group.DisplayName)
Write-Warning "Could not check '$($Group.DisplayName)': $($_.Exception.Message)"
}
}
# Distribution groups and mail-enabled security groups
foreach ($Group in $ExchangeGroups) {
if ($Group.IsDirSynced -eq $true) {
$SkippedSyncedGroups++
continue
}
if (@($Group.ManagedBy).Count -eq 0) {
[PSCustomObject]@{
GroupId = $Group.ExternalDirectoryObjectId
DisplayName = $Group.DisplayName
EmailAddress = [string]$Group.PrimarySmtpAddress
GroupType = if (
$Group.RecipientTypeDetails -eq "MailUniversalSecurityGroup"
) {
"Mail-enabled security group"
} else {
"Distribution group"
}
MembershipType = "Assigned"
OwnershipSource = "Exchange Online"
}
}
}
# Dynamic distribution groups
foreach ($Group in $DynamicGroups) {
if (@($Group.ManagedBy).Count -eq 0) {
[PSCustomObject]@{
GroupId = [string]$Group.Guid
DisplayName = $Group.DisplayName
EmailAddress = [string]$Group.PrimarySmtpAddress
GroupType = "Dynamic distribution group"
MembershipType = "Dynamic"
OwnershipSource = "Exchange Online"
}
}
}
)
# Export to the current user's Documents folder
$DocumentsPath = [Environment]::GetFolderPath("MyDocuments")
if ([string]::IsNullOrWhiteSpace($DocumentsPath)) {
throw "Could not locate the Documents folder."
}
$OutputPath = Join-Path $DocumentsPath "OwnerlessGroupsReport.csv"
if ($OwnerlessGroups.Count -gt 0) {
$OwnerlessGroups |
Sort-Object GroupType, DisplayName |
Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8
} else {
# Write headers so an old report is replaced even when no groups are found
'"GroupId","DisplayName","EmailAddress","GroupType","MembershipType","OwnershipSource"' |
Set-Content -Path $OutputPath -Encoding UTF8
}
Write-Host "Ownerless groups found: $($OwnerlessGroups.Count)" `
-ForegroundColor Green
Write-Host "Report saved to: $OutputPath" -ForegroundColor Green
Write-Host "Synchronized groups skipped: $SkippedSyncedGroups"
if ($FailedChecks.Count -gt 0) {
Write-Warning "$($FailedChecks.Count) ownership checks failed. Those groups are excluded from the report."
}The exported ownerless groups report looks like below.
Use the report to identify groups that need a replacement owner and coordinate with the relevant department or business contact.
After reviewing the results, assign appropriate owners through the relevant admin center or EasyEntra. Where possible, maintain at least two owners to reduce the risk of future ownership gaps.
Use the Built-in Ownerless Group Policy in Microsoft 365
Microsoft 365 includes an Ownerless Group Policy that helps organizations recover ownerless groups automatically. Instead of requiring administrators to manually assign new owners, the policy sends email notifications to active members of the group and asks whether they would like to become the new owner.
If there’s recent activity within the group, Microsoft selects the most active members to receive the invitation. If no activity is available, the policy randomly selects members instead. When someone accepts the invitation, they’re added as a group owner automatically, and the action is recorded in the Microsoft Purview audit log. This feature reduces the administrative effort required to maintain ownership across Microsoft 365 Groups.
Requirements for the Ownerless Group Policy
Before configuring the policy, ensure your organization has an eligible Microsoft 365 subscription.
Supported subscriptions include:
- Microsoft 365 Business Premium
- Microsoft 365 Enterprise E3 and E5
- Office 365 Enterprise E3 and E5
- Microsoft 365 Government G3 and G5
- Microsoft 365 Education A3 and A5
- Microsoft 365 Frontline F1 and F3
If you want to limit ownership notifications to members of specific security groups, Microsoft Entra ID Premium P1 or P2 licensing is also required.
How to Configure the Ownerless Group Policy in Microsoft 365
You can configure the policy directly from the Microsoft 365 admin center.
- Sign in to the Microsoft 365 admin center.
- Expand Settings and select Org settings.
- Open the Services tab.
- Select Microsoft 365 Groups.
- Enable When there’s no owner, email and ask active group members to become an owner.
- Configure the policy wizard parameters:
-
- Who to notify: Set restrictions via security groups if you only want specific titles (e.g., Managers) to take ownership.
- Notification Schedule: Configure the frequency (the default is weekly for up to 4 weeks).
- Sender Address: Pick a specific user account or designated Microsoft 365 Group mail address.
7. Click Save.
This enables the default ownerless group policy.
Limitations of the Ownerless Group Policy
Although Microsoft’s built-in policy is useful, it has a few limitations.
- The policy only works with Microsoft 365 Groups and doesn’t apply to every SharePoint or application-specific group. It also cannot automatically assign a new owner if nobody accepts the invitation.
- Another limitation is that administrators cannot bulk-select custom groups for the policy. You can either target all groups or manually choose individual groups.
Because of these limitations, many organizations still perform regular administrative reviews to identify ownerless groups that require attention.
Assign Group Owners in Microsoft 365 Using EasyEntra
Once you identify an ownerless Microsoft 365 Group, you can use EasyEntra to assign a replacement owner. You can also update ownership before an employee leaves, helping maintain responsibility for the group.
To configure group ownership, do the following.
- Open the affected group’s Group properties and select the Mail tab.
- Click Group Ownership.
- Modify the Owner list to add the appropriate replacement owner or remove an existing owner.
- Click OK twice to apply the changes.
Choose someone familiar with the group’s purpose and membership. Where possible, assign at least two owners to reduce the risk of the group becoming ownerless during future departures or role changes.
