Audit & Report MS Teams Channel Creations Using PowerShell

As organizations increasingly rely on Microsoft Teams to foster collaboration, it becomes imperative for administrators to closely monitor and audit the creation of Microsoft Teams channels. This practice is essential for safeguarding data, efficiently managing resources, and facilitating prompt incident response within the organization. In this blog, we’ll explore how to audit MS Teams channel creations quickly using a PowerShell script. You may wonder what’s the need of PowerShell script when we already native audit logs. Want to know why? Let’s get started!

Auditing Microsoft Teams channel creations is crucial for security to monitor and prevent unauthorized or malicious channels creation, ensuring compliance with organizational policies. Microsoft Teams provides robust auditing capabilities through the Microsoft 365 compliance center.

Follow the steps below in the Microsoft 365 Compliance center to gain insights into channel creations in Microsoft Teams.

1. Sign-in to the Microsoft Purview compliance portal.
2. Navigate to Audit –> New Search.
3. Under ‘Activities’ use the search parameters Added Channel in Microsoft Teams activities.
4. Click Search to review the results for Teams channel creation events.
5. You can also export the results for further analysis or compliance reporting.

In an organization, the IT department often needs to monitor changes in Microsoft Teams, including channel creations and team membership changes. While Microsoft Purview Audit Log Search and Search-UnifiedAuditLog cmdlet offer some capabilities in this regard, it may not provide a comprehensive view or allow for extensive customization. For instance, it might not display all the necessary details immediately, requiring additional steps to obtain the full information.

To address this challenge, an alternative approach could be to utilize a PowerShell script for tracking Microsoft Teams channel creation. This method offers more flexibility and can be tailored to meet specific needs.

• The script uses modern authentication to retrieve audit logs.
• The script can be executed with an MFA enabled account too.
• The script retrieves the audit log for 180 days, by default.
• Allows you to generate a Channel creation audit report for a custom period.
• Helps to find recently created channels. e.g., MS Teams channels created in the last 30 days.
• Exports report results to CSV file.
• Identifies channels created by external/guest users.
• Helps to monitor channels created by a specific user.
• Helps to get private channels creations alone.
• Tracks shared channel creations alone.
• Finds standard channel creations alone.
• Automatically installs the EXO module (if not installed already) upon your confirmation.
• The script is scheduler friendly. i.e., Credentials can be passed as a parameter instead of saved inside the script.
• The script supports Certificate-based Authentication (CBA) too.

Download Script: AuditMSTeamsChannelCreations.ps1

Step 1: Download the script.

Step 2: Start Windows PowerShell as administrator.

Using the simple execution format below, you can quickly get the Microsoft Teams channel creation report for the last 180 days. Therefore, to run this script, you can choose any of the methods below.

Method 1: You can use the method below to run the script with both MFA and non-MFA accounts.

Method 2: Execute the script by explicitly mentioning credentials (Scheduler friendly).

The example provided enables you to schedule a PowerShell script; however, it exclusively accommodates non-MFA accounts. In cases where the admin account employs MFA, you can disable MFA using Conditional Access policy.

Method 3: Furthermore, the script can be run through certificate-based authentication, as detailed later.

Note – If you choose not to invest in CA certificates, you can create self-signed certificates for internal and testing needs. For instructions on registering and acquiring certificates for an Azure app, please refer to the Connect MS Graph with Certificates blog.

The exported report will look similar to the screenshot below.

The output file contains the following attributes:

• Creation Time
• Channel Name
• Created By
• Channel Type
• Team Name
• Additional Audit Data

The script provides some built-in filtering parameters according to your needs, and its use cases are listed below.

• Monitor Teams channel creations for a custom period
• Gain insights on recently created MS Teams channels
• Identify MS Teams channels created by external users
• Audit private channel creations
• Track shared channel creations
• Obtain standard channel creations report
• Schedule a monthly channel creation report

Now, with the audit logging retention extended to 180 days, the script retrieves the audit log for the past 180 days by default. You can use the StartDate and EndDate parameters to retrieve audit data for a custom period. Just run the provided script to export Microsoft Teams channel creations for custom period.

The above example will export all MS Teams channels created between Dec 15, 2023, and Dec 19, 2023.

To track down recently created MS Teams channels in your Microsoft 365 environment, run the script by passing no. of days in the RecentlyCreatedChannel_In_Days parameter. For example,

The exported report shows the list of MS Teams channels that were created in the past 30 days, along with the necessary details.

Monitoring Teams channels created by external users is crucial for ensuring security, compliance, data protection, resource management, etc., in a collaborative environment like Microsoft Teams. It allows admins to quickly identify the source and scope of the issue, enabling a timely and effective response. Run the script with CreatedByExternalUsersOnly parameter to attain the list of teams channels created by guest users.

This example retrieves the Microsoft Teams channels created exclusively by external/guest users.

Private channels in Microsoft Teams establish dedicated spaces for collaboration within your teams. These channels enable you to create a subset within a team, comprising specific individuals who are already members of the respective Teams. Execute this script with the PrivateChannelsOnly parameter to export the private channel creations report.

The above example will export the created private channels in MS Teams for the last 180 days. You can further export all private channels using PowerShell script for valuable insights into the dynamics of both creation and membership within your private channels.

Shared channels make it easy for people to work together inside and outside the organization without messing up the main team. You can add someone to a shared channel without adding them to the whole team. To keep things safe, the team owner and Microsoft Teams admin should keep an eye on shared channel creations. To track adding and removing of shared channels, execute the script with the SharedChannelsOnly parameter.

You can obtain recently created shared channels in the organization.

We all know, by default, all members of a team can create standard channel. Since standard channels are open for all members, it is crucial for admins to keep tabs on standard channel creations. Run this script with the StandardChannelsOnly parameter to monitor standard channel additions in Microsoft Teams.

This example will export you the list of standard channel creations for the past 180 days in the organization.

Microsoft maintains an audit log for a specific duration depending on the type of subscription. If you want to retain the audit log indefinitely, you can accomplish this by scheduling and saving audit reports on your computer. To schedule the PowerShell script, employ the following format in the Windows Task Scheduler.

To automate the monthly report, utilize the provided format and configure it to run on the first day of every month.

This ensures regular and timely generation of channel creation audit reports for effective monitoring.

Effectively monitoring Microsoft Teams channel creations through PowerShell can be a tiresome and time-consuming task, when you have to manage a large number of Teams channels. AdminDroid simplifies the process by providing advanced features within a user-friendly framework. The platform facilitates seamless tracking of Teams channel creations with its intuitive filtering, efficient scheduling, and visually appealing data representations.

You can have full visibility into Microsoft Teams channels list and auditing that keeps you in the loop. Find the list of few reports offered by AdminDroid on Microsoft Teams channels.

MS Teams Channel Auditing Reports:

• MS Teams channel creation and deletion events
• Private channel creations
• Shared channel creations

MS Teams Channels Reports:

• All channels
• Standard channels
• Channels without descriptions

Private Channel Reports:

• All private channels
• Recently created private channels
• Private channels without Team owner/owner

Shared Channel Reports:

• All shared channels
• Recently created shared channels
• Empty shared channels

With AdminDroid’s Microsoft Teams management dashboard, admins can quickly identify the total number of channels, top 5 Teams by channels count, private channels without owner, and more. Streamline administrative control over Microsoft Teams channel management with a visually stunning interface.

If you are still wondering, why AdminDroid? Here is the answer.

Apart from efficient MS Teams management, over 1800 pre-built reports and 30+ dashboards are available for various Microsoft 365 services such as Azure AD, Exchange Online, and SharePoint Online, etc. AdminDroid lets you monitor and manage your entire Microsoft 365 environment. In addition to gaining valuable insights, you can easily schedule and export reports to analyze your organization’s performance.

Download this Microsoft Teams Reporting and Auditing tool today and unlock the full potential of your Microsoft 365 environment!

We hope that our PowerShell script will be helpful in managing channel creations within Microsoft Teams. Feel free to leave a comment if you encounter any issues or have suggestions for enhancements. We will be happy to address your concerns.