What this check looks at
Finds Microsoft 365 groups and Teams with no owner.
Every Microsoft 365 group, and so every team built on one, has owners. Owners approve requests to join, add and remove members and guests, renew the group when the expiration policy asks, receive its access reviews, and answer for what is in its SharePoint site. When the last owner leaves, Microsoft 365 does not appoint anyone: the group carries on with members only.
The check looks at Microsoft 365 (Unified) groups only. It fails when any group has no owner at all, naming up to 20 of them and also counting those with a single owner. It warns when none is ownerless but some have only one owner, because one departure leaves those unmanaged too.
An ownerless team still holds its files, chats and guest list. Renewal emails and access reviews go to owners, so nobody receives them; guests stay indefinitely; requests to join or to remove someone go unanswered or land with IT, who do not know what the team is for. Many ownerless groups are the remains of finished projects or of people who left, holding data nobody has looked at since.
Why it matters
An ownerless group has nobody to approve membership, review guests or answer for its content. It is the most common way a Team quietly outlives its project and keeps a guest list nobody has checked in years.
A typical case: a bid team created for a tender three years ago lost its only owner when the bid manager left. It still holds pricing models, staff CVs and the client’s documents, and two guests from a partner firm can still open it all. When the client asks for its data to be deleted at the end of the contract, nobody knows the team exists.
Unowned data is data nobody can vouch for: it cannot be found for a subject access request with confidence, cannot be deleted on time, and is surfaced by search and Copilot to anyone it was ever shared with.
ISO 27001 control A.5.9 asks for an inventory of information and associated assets with owners, and the NCSC Cyber Assessment Framework’s A3.a asks for the same in asset management. Two owners per group, and Microsoft’s ownerless group policy, keep every team accountable.
How to fix it
Where: Microsoft 365 admin centre → Settings → Org settings → Microsoft 365 Groups
Before you start
- Ask members of each ownerless group who should own it; the most active member is usually right.
Step by step
- List groups with fewer than two owners. In Graph PowerShell, Connect-MgGraph -Scopes Group.Read.All, then run Get-MgGroup -Filter "groupTypes/any(c:c eq 'Unified')" -All | ForEach-Object { [pscustomobject]@{ Name = $_.DisplayName; Id = $_.Id; Owners = @(Get-MgGroupOwner -GroupId $_.Id -All).Count } } | Where-Object Owners -lt 2 | Sort-Object Owners | Export-Csv owners.csv -NoTypeInformation.
- Choose an owner for each, or retire the group. For each group, pick two owners: the manager of the team that uses it and its most active member are usually right. If a group turns out to be finished with, archive or delete it instead (see the stale groups check, NL-COL-006).
- Add the owners. In the Microsoft 365 admin centre, go to Teams & groups > Active teams & groups, select the group, open the Membership tab, choose Owners and select Add owners. For a team you can instead use the Teams admin centre: Teams > Manage teams, select the team, open Members and change the person’s role to Owner.
- Or add owners in PowerShell. For a team, Add-TeamUser -GroupId <group id> -User <user@domain> -Role Owner (Teams module) makes the person a member and an owner. For any group in Graph PowerShell: New-MgGroupOwner -GroupId <group id> -DirectoryObjectId <user id>.
- Turn on the ownerless group policy. In the Microsoft 365 admin centre, go to Settings > Org settings, open the Services tab and select Microsoft 365 Groups. Turn on the option that asks active members to become owners when a group has no owner, choose how many members to ask and for how many weeks, and select Save.
- Require two owners when groups are created. Add "two owners" to however teams are requested (a form, a ticket or a provisioning tool), and repeat the first step every quarter to catch groups that drop to one owner.
- Confirm the change. Run the listing from the first step again: no group should have zero owners, and single-owner groups should be the exceptions you chose to accept. The next assessment shows the ownerless count at zero.
What users will notice
None for members. Owners start receiving renewal and access requests.
How to confirm it worked
Entra ID, Groups, filtered on no owners, shows none of the listed groups.
Frameworks and controls
This check maps to controls in 7 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A3.a Asset management |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Data |
| ISO 27001:2022 | A.5.9 Inventory of information and other associated assets |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Asset management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage ownerless groups and teams (Microsoft Learn)