Modern Microsoft 365 Group Management: New API Features, Policy Controls, and Ownerless Group Safeguards

WHAT’S NEW THIS CYCLE: Deep Dive on Microsoft Graph Group Enhancements

Microsoft has released a set of significant updates for group management in Microsoft 365, primarily via the Microsoft Graph API. These changes, surfaced in June 2024, are designed to address longstanding gaps in group lifecycle automation, notification handling, and ownerless group security. Here’s a precise rundown of what’s been delivered, their status, and where admins will encounter these changes:

• notifyMembers Enumeration Type (GA): Enables programmatic control over notification behaviors for group membership changes. You’ll see this in Microsoft Graph API requests managing groups—PATCH /groups/{id}—with the new notifyMembers property.
• emailDetails Resource (GA): Offers granular insight into group-related emails sent via Graph API. Available at emailDetails, it allows admins to audit which messages are sent, delivery status, and recipients.
• targetOwners Resource (GA): Provides targeting for specific group owners in automation scenarios, crucial for workflows like ownerless group remediation. The resource is integrated into Graph API endpoints for groups and policies.
• ownerlessGroupPolicy Resource (GA): Lets admins define policies for handling groups without owners—automating owner assignment, notification, and compliance actions. Find it under ownerlessGroupPolicy in Graph docs.
• policyRoot Resource (GA): Serves as a central node for accessing and updating tenant-wide policy objects, including group policies, via policyRoot.

Admin Center Path: These features are reflected in the Entra admin center under Groups > Settings > Ownerless Groups and Groups > Policies. For email details, audit logs in Purview now expose group-related mail events with expanded metadata.

PowerShell/Graph Endpoint: All resources are accessible via Microsoft.Graph PowerShell, e.g., Get-MgGroup, Get-MgGroupOwnerlessGroupPolicy, and corresponding PATCH endpoints in Graph.

WHAT’S COMING IN THE NEXT 90 DAYS: Roadmap Planning for Group Admins

• Group Expiration Policy Enhancements: Microsoft will roll out finer controls for group expiration, including custom notification intervals and admin override actions. Preview in late July, GA by September 2024.
• Self-Service Group Ownership Assignment: End users will soon receive prompts to claim ownership of orphaned groups directly within Teams and Outlook, reducing admin workload. Expected Q3 2024.
• Improved Group Activity Analytics: New Purview dashboards will surface inactive and risky groups, with drill-down capability. Preview in August, GA by October.
• Entra ID Portal Integration for Ownerless Group Remediation: The remediation workflow will move from Graph API-only to a clickable process in Entra admin center, simplifying compliance management.

THE UPGRADE: Productivity, Security, and Cost Benefits

The new resources are more than incremental—they transform group management:

• Productivity: Automated notification and owner targeting reduce manual follow-up and support tickets. Group lifecycle actions can be fully scripted with clear audit trails.
• Security: Ownerless groups pose a real risk—no responsible party for membership, resource access, or compliance. The ownerlessGroupPolicy resource allows for systematic detection and remediation, minimizing shadow IT.
• Cost: By automating group cleanup and owner assignment, admins avoid licensing waste and redundant resources. The new analytics inform licensing and renewal decisions.

RELATED M365 CHANGES IMPACTING GROUP ADMIN WORKFLOW

Recent updates to Microsoft Entra ID and Purview further affect group administration:

• Entra ID Dynamic Group Membership: Now supports device attributes, expanding automated group scenarios for Intune-managed endpoints.
• Purview Audit Logs: Audit logs now capture group mail notifications and ownerless group remediation actions, aiding compliance reviews.
• Teams Group Integration: Teams now flags ownerless groups directly in the UI, linking to remediation actions (rolling out Q3 2024).

REPORT — Detecting Ownerless Groups and Notification Settings

To audit ownerless groups and their notification settings, use Microsoft Graph PowerShell. This script paginates results and handles errors, surfacing actionable info:

# Requires Microsoft.Graph.Groups module
Connect-MgGraph -Scopes 'Group.Read.All','Directory.Read.All'

$groups = @()
$skipToken = $null
$hasMore = $true
while ($hasMore) {
    try {
        $params = @{ Top = 50 }
        if ($skipToken) { $params['SkipToken'] = $skipToken }
        $response = Get-MgGroup @params
        $groups += $response
        $skipToken = $response.'@odata.nextLink' -replace '^.*skiptoken=',''
        $hasMore = [bool]$skipToken
    } catch {
        Write-Warning "Error fetching groups: $_"
        break
    }
}

foreach ($g in $groups) {
    $owners = Get-MgGroupOwner -GroupId $g.Id
    if ($owners.Count -eq 0) {
        Write-Output "Ownerless Group: $($g.DisplayName) ($($g.Id))"
    }
    $notify = $g.AdditionalProperties['notifyMembers']
    Write-Output "Group: $($g.DisplayName), notifyMembers: $notify"
}

Note: This script paginates results (via @odata.nextLink and SkipToken) and does not modify any objects. Always review output before considering remediation.

REMEDIATE SAFELY — Assign Owners and Update Notification Settings

To remediate ownerless groups, use Set-MgGroup with -WhatIf, and assign a reviewed owner. Never bulk-assign owners based on live queries without validation.

# Dry-run: assign an owner to a group
$groupId = 'GUID-of-ownerless-group'
$userId = 'GUID-of-reviewed-owner'
Add-MgGroupOwner -GroupId $groupId -UserId $userId -WhatIf

# Dry-run: update notifyMembers setting
Set-MgGroup -GroupId $groupId -AdditionalProperties @{notifyMembers='true'} -WhatIf

Validate that the target user is appropriate for ownership, and confirm notification preferences with business stakeholders. Use -WhatIf for safety—no changes unless explicitly confirmed.

PORTAL EQUIVALENT — Where to Find These Features

• Entra Admin Center: Groups > Settings > Ownerless Groups, Groups > Policies
• Microsoft 365 Admin Center: Groups > Active Groups, audit group notifications under Compliance > Purview > Audit
• Teams Admin Center: Ownerless group flags appear in group properties (Q3 rollout)

RECOMMENDATION — Immediate Actions for Admins

• Audit ownerless groups and notification settings monthly—use the script above, review results, and plan owner assignment.
• Map upcoming group policy changes to your compliance and lifecycle workflows. Prepare for self-service owner assignment and new expiration controls.
• Integrate Purview audit logs for group actions into your compliance reviews.
• Leverage new Graph resources for scripting and automation, but always dry-run and validate before applying changes to production.
• Stay on top of roadmap announcements, especially for Teams and Entra ID group integration.

Prioritise: 1) Ownerless group remediation; 2) Notification control; 3) Policy integration; 4) Audit and analytics.