Every Microsoft 365 group and team is an access grant to a mailbox, a SharePoint site, files and chat history, and in most tenants nobody reviews who still holds it. By default any user with a mailbox can create a team, the creator becomes its owner, and membership then grows through project churn while owners change jobs or leave. Microsoft 365 Copilot and search work within each user's permissions, so stale membership turns into content the wrong people can find. This guide covers owner accountability, membership access reviews in Microsoft Entra ID Governance, and the naming, expiration and ownerless group policies that keep the estate reviewable. It is written for identity governance leads, Microsoft 365 administrators and auditors. Guest account hygiene across platforms is covered in How to audit guest and external users, and nesting and security group sprawl in Group Sprawl and Nested Groups.
This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.
Key takeaways
- Owners are the control. Group and team owners add members, invite guests and approve review decisions, so a review programme is only as good as the owner data behind it; fix ownerless groups before launching reviews.
- Review members, not just guests. The built-in "All Microsoft 365 groups with guest users" scope only reviews guests; employee membership of sensitive teams needs a separate review with the Everyone scope.
- Decide the non-response outcome up front. "If reviewers don't respond" set to No change turns a review into a reporting exercise; Remove access or Take recommendations makes it a control.
- Expiry and reviews do different jobs. The expiration policy removes unused groups, but any activity renews them silently, so busy groups with the wrong members are never caught by expiry alone.
- Naming and creation policy make the estate reviewable. A prefix that encodes department or data class lets you target reviews and reports by risk instead of reviewing thousands of groups equally.
Why groups and teams need their own review
A Microsoft 365 group is the membership object behind a team, its SharePoint site, a shared mailbox and calendar, and Planner. Adding someone to the team gives them all of it. Microsoft's Teams role documentation shows how far that reach is delegated: owners create and delete the team, add members to private teams and promote members to owners, while in public teams any member can add members. Owners can also allow members to create channels and add apps.
Three conditions make membership drift: creation is open to every user with an Exchange Online mailbox unless restricted, owners are whoever created the team, and when an owner's account is deleted the group becomes ownerless. Microsoft notes that a group needs an owner to add or remove members and change settings, so an ownerless team keeps every member it had until an administrator steps in. The governance answer is a cycle: control creation, keep at least two accountable owners, review membership on a cadence set by sensitivity, and expire what is unused.
Owner accountability
Owner data is the foundation for everything else, because "Group owner(s)" is the natural reviewer for membership reviews and the expiration policy emails owners to renew.
- Two owners minimum: set a rule that every group and team has at least two owners from different reporting lines, so one leaver does not orphan it. Report groups with one owner as well as groups with none.
- Owners are reviewed too: owners hold higher rights than members, so include them in reviews. Promotions show up in the Entra audit log as Add owner to group in the GroupManagement category.
- Ownerless group policy: in the Microsoft 365 admin center under Settings > Org settings > Services > Microsoft 365 Groups, turn on When there's no owner, email and ask active group members to become an owner. It emails the most active members weekly for the number of weeks you set, and up to two members per group can accept. Use the security group option to limit who may be offered ownership (for example, exclude contractors). If nobody accepts, the policy stops and an administrator must assign an owner, so track the residue.
- Link ownership to leavers: make owner reassignment a step in the leaver and mover process. See the Joiner-Mover-Leaver Guide, and Entra ID Governance Lifecycle Workflows for automating the task.
- Admin assignment as last resort: administrators can assign owners in the Teams admin center under Teams > Manage teams, on the Members tab. Record who was assigned and why, so the next review has a named accountable person.
Designing membership access reviews
Access reviews for groups and teams are created in the Microsoft Entra admin center under ID Governance > Access Reviews > New access review > Review access to a resource type, then Teams + Groups. Microsoft lists Microsoft Entra ID Governance or Microsoft Entra Suite licensing and the Identity Governance Administrator role as the minimum to create them. Choosing several groups creates a separate review per group.
| Setting | Options | Recommended for sensitive teams | Recommended for general collaboration |
|---|---|---|---|
| Scope | All Microsoft 365 groups with guest users; Select Teams + groups | Select Teams + groups, targeted by naming prefix or label | All Microsoft 365 groups with guest users |
| Users | Guest users only; Everyone; Inactive users (on tenant level) with up to 730 days | Everyone | Guest users only (the only option with the all-groups scope) |
| Reviewers | Group owner(s); Selected user(s) or groups; Users review their own access; Managers of users | Multi-stage: group owners, then a data owner or security reviewer | Group owner(s) with a fallback reviewer |
| Fallback reviewers | For owner and manager reviews when there is no owner or manager | Named governance team | Named governance team |
| Recurrence and duration | Duration in days, start date, end never, on a date or after a number of occurrences | Quarterly, 14 days | Semi-annual or annual, 14 to 21 days |
| If reviewers don't respond | No change; Remove access; Approve access; Take recommendations | Remove access | Take recommendations |
| Auto apply results to resource | On or off | On, after a pilot cycle | On |
| Denied guests | Remove membership; Block sign-in for 30 days, then remove from the tenant | Remove membership | Block then remove, if the guest has no other access |
| Decision helpers | No sign-in within 30 days; User-to-Group Affiliation | Both on | No sign-in within 30 days |
| Justification required | On or off | On | On |
Decision guidance: owner review is fast and scales, but owners tend to approve people they work with. For teams that hold regulated or confidential data, add a second stage with a data owner who sees earlier decisions (the Show previous stage(s) decisions to later stage reviewers setting) and send only approved reviewees forward. Self-review ("Users review their own access") suits large, low-risk communities where the goal is to shed people who no longer need membership, but it is not an independent check and should not be your evidence for sensitive data. Manager review fits groups that map to org structure; it works poorly for cross-functional project teams.
Limits to plan around: Microsoft notes that the all-groups scope excludes dynamic and role-assignable groups, that B2B direct connect users and Teams shared channels are included only in single-stage reviews, and that groups in a restricted management administrative unit cannot be reviewed. Dynamic group membership is governed by its rule, so review the rule instead; role-assignable groups belong in your privileged access process. See Access Reviews Guide for campaign design across systems and Access Review Checklist for evidence.
Delegation: the Group owners can create and manage access reviews for groups they own setting (default No) lets owners run their own reviews. Leave it off unless you have a central catalogue of which reviews exist; otherwise review coverage becomes hard to prove.
Expiration, naming and creation policies
The expiration policy details (one policy per tenant, minimum 30-day lifetime, activity-based renewal, 30-day restore window) are covered in Group Sprawl and Nested Groups. What matters for an access review programme is how the three policies interact.
| Policy | Where | What it governs | What it does not do | Licensing note |
|---|---|---|---|---|
| Expiration | Entra admin center, Groups, Expiration | Deletes Microsoft 365 groups that are not renewed; owners get notices 30, 15 and 1 day before; ownerless groups notify the alternate email | Does not review members. Any SharePoint file activity, group message or Teams channel visit renews the group silently | Entra ID P1 or P2 held for members of covered groups |
| Naming | Entra admin center, Groups, Naming policy | Prefix and suffix (fixed strings or attributes such as [Department]), up to 5,000 blocked words, 63-character total | Does not rename existing groups until an owner edits the name; Global Administrator and User Administrator are exempt | Entra ID P1 held per member of Microsoft 365 groups |
| Creation restriction | Group.Unified directory settings EnableGroupCreation and GroupCreationAllowedGroupId | Limits who can create groups and teams to members of one group | Does not block admin roles, which can create from their own admin centres | Entra ID P1 for the allowed creators |
| Ownerless group | Microsoft 365 admin center, Org settings, Microsoft 365 Groups | Asks active members to take ownership | Takes no action if nobody accepts | Listed Microsoft 365 suites or Entra premium plan |
Use expiration for the long tail and reviews for the groups that matter. A practical lifetime is 180 or 365 days for general collaboration, with Selected scope (up to 500 groups) only during a pilot and then All. Because renewal is activity-based, an active team with a former contractor still in it renews indefinitely; that is the gap the review fills. For naming, encode what reviewers need to target: a prefix for department and a suffix or label for data sensitivity lets you build the "Select Teams + groups" list for quarterly reviews from a name filter. Pair naming with sensitivity labels on containers: see the Microsoft Purview Information Protection Guide.
Rolling out the programme
- Baseline: export every Microsoft 365 group with owner count, member count, guest count, creation date, last activity and whether it is team-enabled. Flag groups with zero or one owner.
- Fix ownership: enable the ownerless group policy, assign owners to the residue manually, and set the two-owner rule for new groups.
- Classify: tag groups by data sensitivity (label or naming suffix) so you can tier reviews. Turn on the naming policy for new groups.
- Pilot reviews: run one guest review across all groups and one Everyone review for 10 to 20 sensitive teams with auto apply off. Read decisions and the "No sign-in within 30 days" recommendations to see how owners behave.
- Turn on enforcement: enable auto apply, set the non-response outcome, make the reviews recurring and add a fallback reviewer.
- Expire the long tail: enable the expiration policy on Selected groups, then All, with an alternate notification address for ownerless groups.
- Restrict creation where justified: large or regulated tenants can limit creation to a requester group fed by a request process; small tenants usually do better with naming and expiry than with a creation bottleneck.
Rollback: a membership removed by an auto-applied review can be re-added by an owner or administrator, and the decision is recorded in review history. A group deleted by expiry can be restored by an owner or administrator within 30 days; Microsoft notes that data from apps such as Planner, sites and Teams is permanently deleted 30 days after deletion, so the restore window is firm. Tell owners before the first enforced cycle.
Small versus large organisations: a tenant with a few hundred groups can review all members of all teams annually with owner reviewers and a single fallback. Tenants with thousands of groups should tier: quarterly Everyone reviews for sensitive teams, semi-annual guest reviews everywhere, and expiry for the rest.
Where identity fits
Group membership is an entitlement like any other, so it belongs in the same catalogue and certification evidence as application roles. Two identity types need attention beyond people. Service accounts and automation identities sometimes hold team ownership so that provisioning scripts can manage membership; they cannot answer an access review or an ownership email, so give each a human sponsor and exclude them from owner reviews only with that sponsor recorded. Microsoft 365 Copilot and enterprise search surface content according to each user's permissions, so membership reviews directly reduce what an AI assistant can retrieve for the wrong person. See the Entitlement Catalogue Guide and the Microsoft 365 Copilot Security Deep Dive.
Detection and measurement
Watch the Entra audit log for changes between reviews, because a review only proves membership on the day it closed.
| Event (audit activity) | Category | What to look for |
|---|---|---|
| Add member to group | GroupManagement | Additions to sensitive teams outside a request process, especially guests or bulk additions |
| Add owner to group / Remove owner from group | GroupManagement | Owner changes on sensitive teams; removal of the last owner |
| Delete group / Restore group | GroupManagement | Expiry deletions and restores of sensitive groups |
| Create access review / Update access review / Delete access review | Access reviews | Changes to review definitions, particularly turning off auto apply or deleting a review |
| Apply decision / Auto apply review | Access reviews | Evidence that removals were enforced |
| Unattended ownerless group; Updated the ownerless group policy | Microsoft Purview audit | Ownerless notifications, responses and policy changes |
Unexpected membership or owner additions are also how attackers persist after taking over a cloud account (MITRE ATT&CK T1098 Account Manipulation, with T1078.004 Cloud Accounts for the initial access). See the Microsoft 365 Unified Audit Log Guide for Detection.
Metrics:
- Ownership coverage: percentage of Microsoft 365 groups with two or more active owners (target above 95%).
- Review coverage: percentage of sensitive teams with a completed Everyone review in the last quarter.
- Reviewer response rate: percentage of decisions made by reviewers rather than by the non-response default.
- Removal rate: percentage of reviewed memberships removed per cycle; near zero over several cycles suggests rubber-stamping.
- Time to owner: median days from a group becoming ownerless to a new owner being assigned.
- Expiry yield: groups deleted by expiry per quarter, and the share restored (a high restore share means the lifetime is too short).
Framework mapping
| Framework | Reference | How this guide maps |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 | Membership defined, managed and periodically reviewed with least privilege |
| NIST CSF 2.0 | PR.AA-01, GV.RR-02 | Identities managed; owner roles and responsibilities assigned |
| NIST SP 800-53 Rev 5 | AC-2, AC-2(3), AC-2(4) | Account and group management, removal of inactive access, audit of membership changes |
| NIST SP 800-53 Rev 5 | AC-6, AC-6(7), AU-6 | Least privilege, review of privileges, audit review |
| CIS Controls v8.1 | 5.1, 5.3, 6.2 | Account inventory, disabling dormant accounts, access revocation process |
| ISO/IEC 27001:2022 Annex A | 5.15, 5.18 | Access control; access rights provisioning, review and removal |
| MITRE ATT&CK v20 | T1098, T1078.004 | Membership and owner changes as persistence after cloud account compromise |
Common failure patterns
- Guest-only reviews treated as complete: the all-groups scope reviews guests, so employees who moved teams years ago keep access to sensitive sites. Add Everyone reviews for tiered groups.
- Reviews sent to ownerless groups: with no owner and no fallback reviewer, decisions never happen and the non-response default decides everything. Fix ownership first and always set a fallback.
- No change on non-response: low response rates leave every membership in place, while the report shows a completed review. Use Remove access or Take recommendations once the pilot is done.
- Relying on expiry for active teams: a single channel visit renews a group, so busy teams with stale members never expire. Expiry is a hygiene tool, not a review.
- Naming policy switched on with no plan for existing groups: only new or edited groups comply, so targeting reviews by prefix misses the legacy estate. Back-fill names or use labels.
- Owner reviews of owners: owners approve themselves and each other. Have a fallback or second-stage reviewer certify owner assignments on sensitive teams.
Practitioner checklist
- Export all Microsoft 365 groups with owner, member and guest counts and last activity; fix groups with fewer than two owners.
- Turn on the ownerless group policy with a security group that limits who may be offered ownership.
- Add owner reassignment to the leaver and mover process.
- Run a recurring guest review across all groups with guests and a fallback reviewer.
- Run quarterly Everyone reviews for sensitive teams, multi-stage where data owners must sign off.
- Set auto apply on and choose Remove access or Take recommendations for non-response after the pilot.
- Enable the expiration policy with an alternate notification address and tell owners about the 30-day restore window.
- Enable a naming policy that encodes department or sensitivity, and back-fill existing sensitive groups.
- Alert on owner and member changes to sensitive teams and on edits or deletion of review definitions.
- Report ownership coverage, review coverage, response rate and removal rate to the governance board.
Standards and references
- Microsoft Learn: Create an access review of groups and applications in Microsoft Entra ID
- Microsoft Learn: Configure the expiration policy for Microsoft 365 groups
- Microsoft Learn: Enforce a naming policy on Microsoft 365 groups
- Microsoft Learn: Manage ownerless Microsoft 365 groups and teams
- Microsoft Learn: Assign team owners and members in Microsoft Teams
- Microsoft Learn: Microsoft Entra audit log activity reference
Related NHI Mgmt Group resources: How to audit guest and external users · Group Sprawl and Nested Groups · Microsoft Teams Security Guide · Access Reviews Guide · Entra ID Cross-Tenant Access and B2B Guest Governance Guide