WIP

Scenario

Let say you administer a large Microsoft 365 environment (e.g. ~100k+ users and/or ~50K+ sites) and after some years you have a lot of ownerless groups and sites (around 5k probably), and a lot of inactive groups and sites (maybe 15k). And new ownerless groups are coming at a pace of dozens per week? You a thinking of stopping bleeding and cleaning this up…

Out-of-the-box we have Microsoft 365 groups expiration policy and Microsoft 365 ownerless groups policy. You might also have some 3-rd party tools implemented – e.g. ShareGate, SysKit.

If you do not care – you might just activate both OotB Microsoft policies – via GUI – they are simple to activate. But once you activated policies – they will trigger thousands of emails. Now imagine a person is getting dozens of emails asking him/her to be an owner or to renew the group that maybe does not make much sense… What’ll happen? Right, people will probably ignore these notifications. What will happen next? Groups and sites will be automatically deleted. And then? Right, there will be a noise and many angry users and high-priority tickets and you will have to restore sites/teams and finally you’ll have to look for groups owners manually.

So, what is the right way to clean-up a large Microsoft 365 environment from ownerless and inactive teams, groups sites?

Not a trivial question, hah?

Solution

Disclaimer: I’m sharing here my personal opinion with no obligations or warranty etc., so you’d dig into all the technologies used and based on your particular situation build your own plan.

It’d be a good idea to discuss it with you org’s communication team and helpdesk/service-desk to adjust clean-up activities with other initiatives and let other people be prepared.

High-level steps for group-based Sites:

• consider implementing Minimum 2 owners per group policy to stop bleeding and apply this policy to groups where you already have 2+ owners – it’ll be safe; currently Microsoft does not have such functionality, so consider 3-rd party tool like SysKit
• consider custom PowerShell clean-up, e.g. you can simply delete groups with no owners and no members and/or inactive groups with no content and/or groups that are inactive for a long time (this must be aligned with business and legal)
• implement Microsoft’s Ownerless group policy in “Clean-Up” configuration; there are some tricks and gotchas worth a separate post, but in short
  • avoid scoping down this policy via people (security groups)
  • implement it for all groups all users with 6-7 weeks and custom e-mail template
• implement Microsoft groups expiration policy in “Clean-Up” configuration… again, there are a few different strategies – see below
• change Microsoft Ownerless groups policy configuration to a “Permanent” mode configuration set
• change Microsoft 365 groups expiration policy with a “Permanent” mode configuration

All above was mostly about group-based sites (as we have OotB Microsoft policies for groups), but we probably have the same problem (or even worth) with standalone sites (TBC).

Implementing Microsoft 365 groups expiration policy

If you are thinking of activating in an existing environment – you would probably have a spike – all the old groups will be subject to policy. The ide is to avoid situation when a specific person – group owner will get dozens of email. It would be better if a person will receieve, let say one email per week.

Here is my 4 possible approaches to avoid this spike, distribute notifications evenly across the time and ease the pain:

By changing Group Lifetime

You would need to change the policy every, e.g. week, specifying different group lifetime in days period. Consider
– calculate number of days between the oldest group created an today, plus 35 days – it’ll be your first “group lifetime”
– activate the policy with this number of days in “group lifetime” – and within a week you will get notifications on the oldest group/groups
– after a week or two – change the “group lifetime” decreasing it by e.g. 30-60 days and reactivate the policy… and so on

You can easily calculate it all and choose your pace depending on how many groups you have to renew, how much time you need to clean-up. You got the idea.

Downside – in the email notification it will be said “otherwise the group will be deleted on …”, but once you start joggling with dates – this will not be true probably.

By renewing groups as admin

tbp

By sending customized e-mails to users

tbp

By sending users to the groups page

tbp