Every team in Microsoft Teams or a Microsoft 365 group or a SharePoint site must have an owner/owners. Otherwise to whom we communicate on any question – site/group permissions, membership, site/group/team retention policy, content classification etc. Who will be responsible for team/site/group content and configuration and who will provide access to this site for other users.

MS: A team in Microsoft Teams or a Microsoft 365 group and its related services can become ownerless if an owner’s account is deleted or disabled in Microsoft 365. Groups and teams require an owner to add or remove members and change group settings.

Recently Microsoft implemented a new feature: a policy that automatically asks the most active members of an ownerless group or team if they’ll accept ownership. Very important feature. TY Microsoft!

The configuration via wizard is straightforward and intuitive.

But still we have some questions regarding the policy.

Q: Why it is important?
A: Because many other “governance” activities (e.g. permissions attestation, retention policies) rely on site/team ownership. I.e., before we notify site owner that the site is going to be deleted due to inactivity – we want an owner present.

Q: Is it about groups ownership or sites ownership?
A: Group ownership and group-based sites ownership (teams, yammer etc.). Non-group based aka Standalone sites (e.g. communication) are not in scope of this feature/policy.

Q: Who can configure this policy? What kind of permissions required to create/update policy?
A: Microsoft says “Manage Microsoft 365 groups” permissions required – e.g. admins with Global admin or Groups Admin roles required. “Teams administrator” or “SharePoint Administrator” cannot configure the policy.

Q: How about group with no members? What if somebody created a group but did not add any members?
A: Assuming somebody created a group and left company. In this the policy will not work – as there is nobody who can be a new owner. This kind of groups must be handled manually, as no owners no members does not mean nobody uses related SharePoint site.

Q: How do we know the group is ownerless? Only if owner has been deleted from AAD? What if an owner is just blocked or unlicensed?
A: blocked or unlicensed users are still users; so the policy will be triggered if the group owners list is empty.

Q: We have implemented Azure AD Settings “EnableGroupCreation” and “GroupCreationAllowedGroupId” (as per Microsoft: Manage who can create Microsoft 365 Groups), so not everyone can create m365 groups. Would this impact ownerless groups policy? In other words – if a user cannot create group – would this keep user from being assigned as a group owners?
A: No. Microsofts’ Manage who can create Microsoft 365 Groups trick regulates groups creation only. Later – when a group is created – nothing prevents such user to be added as a group owner.

Q: I support a large Microsoft 365 environment and we already have hundreds of ownerless groups. I’m concerned how users might react and whether our helpdesk support teams are ready for new type of tickets etc. Implementing the policy in test/stage environment does not make much sense, since there are no really active users etc. So, can I test this policy in production – on real users, but pilot it within a small number of users or ownerless groups before applying to all groups in the environment.
A: Yes, you can do a test or pilot implementation in production limiting the impacted users or groups.
– if you need to limit users who will be getting notifications a “pilot team” – during Step 1 “Notification Options” under “Specify who can receive ownership notifications” you can select “Allow only certain active members” and under “Specify security groups to ‎allow members‎” you can select a security group – so only members from the specified security group will be sent ownership request. Microsoft 365 groups do not work here.

NB: But there is a bug (I believe): When you specify this option (Allow only certain active members and a security group) – the policy just does not work.

another option – you can test the policy on a several selected m365 groups:

Q: I know the policy is applied to Microsoft 365 groups only. But I have many standalone sites with no owners (no site collection administrators). How do I deal with ownerless SharePoint sites?
A: How about converting standalone sites to Microsoft 365 group-based sites (TBC)?

Q: What happens to group that become ownerless after the policy is created?
A: The policy will be triggered against this group – so next day the most active group members will receive invitation.

Q: What happens if several of the notified members accepts the ownership request?
A: Two first served basis. As per Microsoft, only two members can be assigned to group owners via the policy. When a group got two owners – invitation message actionable item for the rest will be converted from “Would you like to be a group owner?” to “MemberName1 and MemberName2 have already agreed to become group owners.” with no “Yes” and “No” buttons.

Track the ownerless group policy in action via Audit Log

How do I, as an Microsoft 365 administrator, know if the policy works or not, are the emails sent or not and how many (if any) users are accepted “Would you like to be a group owner?” invitation?

Microsoft 365 Audit Search under Microsoft Purview (Compliance center) should help.

Operations:

• OwnerlessGroupNeedAttention – “Unattended ownerless group”
• OwnerlessGroupNotified – “Notified ownerless group”
• OwnerlessGroupNotificationResponse – “Responded to ownerless group notification”

UserId: OwnerlessGroupComplianceAssistant

Record Type (AuditLogRecordType): 126

It seems like event is not added to the Audit log when a policy is created or updated.

Some more findings:

If a public group does not have an owner – all requests to joint the team will be declined with “The team does not have an owner” message:
(that means no new members, i.e. no new contributors, but read-only visitors access is sill available for everyone, as group is public):

Users can go to My Groups to see groups (Teams, Yammer communities and SharePoint Sites) they are members or owners of.

Proposal to be a group owner lasts forever. So if a user after some time finds an email that asks him “Would you like to be a group owner?” and clicks Yes – he/she will be a group owner, even if the policy is already updated or removed.

As per Microsoft, only first two members can accept the ownership of an ownerless group. No additional members are allowed to accept ownership. If either one or two members accept ownership, other members won’t receive further notifications.

Q: Can I customize an ownership notification?
A: Yes, but
– E-mail message body is limited to ~1040 character
– Policy does not provide any WYSIWYG rich text format, but you still can format it – headers, bold/italic, links, bullets/lists: more on email template format.

A member can forward invitation message, but recipient will not see actionable “Yes” “No” buttons.

Q: Can I use shared mailbox as a “send from” e-mail account?
A: No. You can use user or m365 group mailbox.

Q: We know, that if user declined ownership – he well not get more emails. Is that true for current policy or for any further policies? I.e. If the policy updated – will it remember user’s decision or it all starts from scratch?
A: ???

Q: Let say we specified security group to limit user who will get invitations. Let say there were 10 members in the ownerless group but only included 6 users from the orphan group into the security group. Microsoft says the policy will select the most active users. So question – the policy will select the most active users from the 10 group users and if the user in the security group – he/she will get an email, or the policy will select the most active users only from these 6 users that included in the security group, ignoring 4 users, even if they were more active then these 6 selected?
A: ???

Who can create Microsoft 365 Groups

It is possible to limit users – who can create Microsoft 365 Groups (please refer to Microsoft: Manage who can create Microsoft 365 Groups – there is a guide and PowerShell code sample). This might help to keep the environment under control – let say, “only managers can create groups”, or “contractor should not be able to create teams”.

It would be good if the configuration would be consistent in terms “if a user cannot create a group – user cannot be a group owner”. Unfortunately, with current configuration options (Aug 2022), this is not the case.
Azure AD Directory Setting “GroupCreationAllowedGroupId” works only for creation. Later, when the group is create – it is possible to add to group as a group owner those who is not able to create group.

Issues

“Ownerless group policy configuration failed” error message.
And “Failure in configuring ownerless groups policy” and “Please try again.”
– seems like a permission issue.
SharePoint admin, Teams admin or Group admin roles: cannot configure Ownerless Groups Policy.
Global admin: yes, can configure Ownerless Microsoft 365 Groups Policy.
What is the minimum role required?
According to a recent update of the Microsoft’s article – “A Global administrator can create a policy…”

References

• Microsoft: Manage ownerless Microsoft 365 groups and teams
• Microsoft: Manage who can create Microsoft 365 Groups
• Vladilen: Ownerless policy e-mail message formatting