Group & Teams Sprawl Trend

The question it answers: How many Microsoft 365 groups and teams were created in the last 12 months, by whom, and how many are empty, ownerless or short-lived?

How fast are new teams and groups appearing, who creates them, and how many are abandoned - deleted again within weeks, never given a member, or left without an owner? A steady stream of short-lived groups points at a self-service creation policy that needs a naming, approval or expiration rule.

Note

Deleted groups leave the recycle bin after 30 days, so ‘deleted after N days’ only counts groups deleted in the last month. ‘Members’ is capped at 20 by Graph’s $expand - 20+ means 20 or more.

At a glance

Where in the app	Tenant › Group & Teams Sprawl
Workload	Tenant
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	None; creator lookup reads audit logs (about 7 days of history; 30 days with Microsoft Entra ID P1).
Report id (API and MCP)	tenant.collaboration.group-sprawl

Columns

Column	Key	Type
Group	Name	Link
Type	Kind	Status
Status	Status	Status
Created	Created	Date
Created by	CreatedBy	Text
Members	Members	Text
Owners	Owners	Text
Deleted	Deleted	Date

Filters

Filter	Key (API)	On when the page opens
Only empty, ownerless or short-lived groups	abandoned	No

What it needs

Licence: None; creator lookup reads audit logs (about 7 days of history; 30 days with Microsoft Entra ID P1).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Group.Read.All	Microsoft Graph	Read all groups
AuditLog.Read.All	Microsoft Graph	Read all audit log data	creators - optional

Data sources it reads

• GET /v1.0/groups?$filter=groupTypes/any(c:c eq 'Unified')&$expand=owners / members
• GET /v1.0/directory/deletedItems/microsoft.graph.group
• GET /v1.0/auditLogs/directoryAudits?$filter=activityDisplayName eq 'Add group'

Through the API and MCP

GET /ir-api/v1/reports/tenant.collaboration.group-sprawl?size=100
GET /ir-api/v1/reports/tenant.collaboration.group-sprawl?filter=abandoned

An AI assistant reads it with the MCP tool get_report and the id tenant.collaboration.group-sprawl. The client needs the Read grant for Tenant. See Using the API.