Table of Contents
Periodic Capture of Teams Membership Details for Record Purposes
I receive email all the time to ask me whether something is available inside Microsoft 365 or could be built with some code. Sometimes I wish people would do their own research first (or read our PowerShell book), but often sending email is about the limit of research that happens. Using the free versions of Copilot or ChatGPT is a good way to do basic research. The code that these tools suggest is often flawed, but the overall output can give a good steer to find a solution.
In any case, a lawyer asked if it is possible to create “snapshots” of Teams memberships for record-keeping purposes. I can’t say why an organization would want this information except to be able to verify that someone had access to information available through the team at a certain point. Remember, team members have access topics discussed in channels and to the files stored in the SharePoint Online site used by the team (and potentially, to sites used by private and shared channels belonging to the team). In addition, team members might have access to other confidential information like plans. In short, team membership can be an access all areas ticket to lots of sensitive content.
Another request in the same area is how to monitor changes to group (team) membership. This is easily done by checking the audit log, all explained in this article.
What Teams Membership Proves
Of course, team membership isn’t very good proof of anything. Just because I am added to a team doesn’t mean that I access any of the information accessible to team members. Being able to say that someone was a team member on a certain date only proves that they could have accessed a file or message or other content.
Better proof is available through audit records, but only if an application like SharePoint Online captures audit records for actions like file opens and modifications. Although Teams captures audit records for activities like sending or deleting messages (or even using reactions to respond to messages), the audit log doesn’t create records when members use Teams clients to read channel messages (records are available when an app uses a Graph API to read Teams messages). Third-party Teams apps don’t capture audit records at all, so only an incomplete picture of user activity within a team can be formed.
Capturing Teams Membership
Generating a report of Teams membership is not difficult. The script needs to connect to the Microsoft Graph with the right permissions (like GroupMember.Read.All to read group membership) and select the users to process. In most cases, it’s unlikely that an organization will want to report every user with a Teams license, so I used a group. A dynamic group would be a good choice here.
After settling on the users to process, all the script must do is cycle through each account to run the Get-MgUserJoinedTeam cmdlet to fetch the set of teams the account belongs to. After that, all that needs to be done is to populate the report with the list of teams. I don’t think the report requires pretty formatting, so the script outputs either an Excel worksheet (Figure 1) or a CSV file, depending on the availability of the ImportExcel module.
The report data includes the identifiers for the users and the teams to make it easy to sort and find information.
You can download the full script from the Office 365 for IT Pros GitHub repository.
Automating the Snapshot Process
Creating snapshots of team memberships is the kind of process that is very suited to being run as an Azure Automation runbook on a scheduled basis to collect the membership data periodically. The same runbook that creates the output file could upload the file to a SharePoint Online site to make sure that the file is available to those who need to review the data.
Tracking team membership and the changes made to membership aren’t tasks that every Microsoft 365 tenant will want to do, but if you need this facility, it’s possible with PowerShell.
Need help to write and manage PowerShell scripts for Microsoft 365, including Azure Automation runbooks? Get a copy of the Automating Microsoft 365 with PowerShell eBook, available standalone or as part of the Microsoft 365 for IT Pros eBook bundle.