Audit logs for unified groups

Question

Hi

One of my team site got deleted and it has been restored back. I want to check the logs who has deleted the team site or unified group. from the compliance search i am getting below error.

When i use the below syntax i am getting output. but i am not getting the information as who has deleted the group. how can i export to csv file.
All done - Group deletion records for the last 90 days
User deletions: 123
Policy deletions: 10
Group hard deletes: 14

CLS; Write-Host "Searching Office 365 Audit Records to find auto-expired group deletions"  
 $StartDate = (Get-Date).AddDays(-90); $EndDate = (Get-Date)   
 $PolicySoftDeletes = 0; $HardDeletes = 0; $UserSoftDeletes = 0  
 $Records = (Search-UnifiedAuditLog -Operations "Delete Group" -StartDate $StartDate -EndDate $EndDate -ResultSize 1000)  
 If ($Records.Count -eq 0) {  
     Write-Host "No audit records for group deletions found." }  
 Else {  
     Write-Host "Processing" $Records.Count "team deletion audit records..."  
     $Report = [System.Collections.Generic.List[Object]]::new() # Create output file   
     # Scan each audit record to extract information  
     ForEach ($Rec in $Records) {  
       $AuditData = ConvertFrom-Json $Rec.Auditdata  
       $User = $AuditData.UserId.Split("_")[0]      
       Foreach ($Prop in $AuditData.ExtendedProperties) { If ($Prop.Name -eq "targetName") { $GroupName = $Prop.Value }}  
           Switch ($User)  
           {  
             "Certificate"  { # Hard delete of a group   
                  $HardDeletes++   
                  $Reason = "Group permanently removed"   
                  $User = $User + " (System Process)" }  
             "ServicePrincipal" { #Soft delete - expiration policy   
                  $PolicySoftDeletes++  
                  $Reason = "Group removed by expiration policy"  
                  $User = $User + " (System Process)" }  
             default { #Regular delete by a user   
                  $UserSoftDeletes++   
                  $Reason = "User deleted group" }  
           }         
           $ReportLine = [PSCustomObject] @{  
            TimeStamp = Get-Date($AuditData.CreationTime) -format g  
            User      = $User  
            Group     = $GroupName   
            Reason    = $Reason  
            Action    = $AuditData.Operation  
            Status    = $AuditData.ResultStatus }          
       $Report.Add($ReportLine) }  
 }  
 Cls  
 Write-Host "All done - Group deletion records for the last 90 days"  
 Write-Host "User deletions:"     $UserSoftDeletes  
 Write-Host "Policy deletions:"   $PolicySoftDeletes  
 Write-Host "Group hard deletes:" $HardDeletes  
 Write-Host "----------------------"  
 $Report | Sort Group, Reason -Unique | Format-Table Timestamp, Group, Reason, User -AutoSize  

Answer 1

Hi @Glenn Maxwell ,

To the Audit search result issue shown in the screenshot, I couldn‘t reproduce this on my end. I would suggest you open a service request in Microsoft 365 admin center to confirm it with Microsoft.

To exprot audit report contains activities like "Deleted group" and "Deleted site" to a .csv file, you can use Search-UnifiedAuditLog. The values set after the parameter -Opreations should be "SiteDeleted" corresponding to the activity "Deleted site and "GroupRemoved" corresponding to the activity "Deleted group"(in the Site permissions activities category).

For example,

Search-UnifiedAuditLog -EndDate (Get-Date) -StartDate (Get-Date).AddDays(-90) -Operations "SiteDeleted","GroupRemoved" | export-csv c:\AuditReport.csv  

For a list of the available values for the parameter -Operations, see Audited activities.

As per my test, I can find who has deleted the team site or unified group from the UserIds column.

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.