What this check looks at
Identifies Microsoft 365 groups that appear inactive, indicating no lifecycle policy is in force.
A Microsoft 365 group lives until someone deletes it. The group expiration policy in Microsoft Entra ID gives groups a lifetime (180 or 365 days, or a custom number of at least 30). Groups in use are renewed automatically, the owners of inactive ones are emailed to renew, and a group nobody renews is deleted at the end of its lifetime and can be restored for 30 days. Without the policy, nothing ever expires.
The check uses each group’s renewal date, or its creation date if it has never been renewed, and counts Microsoft 365 groups not created or renewed in the last 365 days. It fails when that is 25% or more of the groups, and warns when there are some but fewer than 25%. With an expiration policy, active groups are renewed, so a large share without renewal for a year usually means no policy is in force.
Old groups and teams are not harmless. They keep their SharePoint sites, files, mailbox, members and guests. People who left the project keep access, sensitive files stay findable in search and in Microsoft 365 Copilot, and storage keeps growing. Nobody can say whether the content should still be kept, so it is kept by default, the opposite of what UK GDPR’s storage limitation principle asks.
Why it matters
Every abandoned Team keeps its files, chat history and guest list alive forever. It is storage you pay for and a data-retention obligation nobody has assessed.
A typical case: a 200-person housing association finds it has 400 teams, more than half untouched for over a year, several holding tenants’ personal details from repair projects finished long ago. A single subject access request now means searching all of them, and the tenant’s SharePoint storage has reached its quota, so the association buys extra storage for content nobody uses.
The cost is ongoing: storage, slower searches and reviews, and a larger exposure in any breach. An expiration policy makes the clean-up happen as part of normal work rather than as an occasional project.
ISO 27001 control A.5.9 (inventory of information and associated assets) and the NCSC Cyber Assessment Framework’s A3.a on asset management both expect information to be kept track of through its life. Group expiration needs Microsoft Entra ID P1 for the members of groups it covers.
How to fix it
Where: Entra admin centre → Identity → Groups → Expiration
Before you start
- Tell group owners that renewal emails will come, and what happens if they are ignored (the group is deleted after the expiry period, recoverable for 30 days).
Step by step
- Review the stale groups in the evidence. Send each owner the groups of theirs not renewed in a year and ask whether each is still needed. For a finished team that holds records, archive it in the Teams admin centre (Teams > Manage teams > select the team > Archive), which keeps it read-only. Delete the rest in the Microsoft 365 admin centre (Teams & groups > Active teams & groups > select > Delete); deleted groups can be restored for 30 days.
- Protect content you must keep before anything expires. If some groups hold records the business must keep, make sure a retention policy covers Microsoft 365 group mailboxes and sites first (see NL-COL-011). Retained content survives the group’s deletion.
- Tell owners what to expect. Let group owners know they will get renewal emails for groups that look inactive, that active groups renew themselves, and that an ignored group is deleted at the end of its lifetime but can be restored for 30 days.
- Turn on group expiration. In the Microsoft Entra admin centre, go to Entra ID > Groups > Expiration. Set Group lifetime (in days) to 180 (or 365), enter an email contact for groups with no owners (a monitored shared mailbox), set "Enable expiration for these Microsoft 365 groups" to All (or Selected to try it on a few first), and select Save.
- Or turn it on in Graph PowerShell. Connect-MgGraph -Scopes Directory.ReadWrite.All, then run New-MgGroupLifecyclePolicy -GroupLifetimeInDays 180 -ManagedGroupTypes All -AlternateNotificationEmails "it@<domain>".
- Confirm the change. Get-MgGroupLifecyclePolicy shows the lifetime and ManagedGroupTypes All, and a group’s overview in the Entra admin centre shows an expiry date. As active groups renew over the following months, the share of stale groups at each assessment falls.
What users will notice
Owners of inactive groups receive renewal emails. Active groups renew automatically.
How to confirm it worked
Entra ID, Groups, Expiration shows a lifetime set and applies to all Microsoft 365 groups.
Frameworks and controls
This check maps to controls in 5 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A3.a Asset management |
| Zero Trust | Data |
| ISO 27001:2022 | A.5.9 Inventory of information and other associated assets |
| NIST CSF 2.0 | ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles |
| NCSC 10 Steps | Asset management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Microsoft 365 group expiration policy (Microsoft Learn)