How to find groups without owners in Microsoft Entra ID

Before you start

Use an account with a role that can read group owners, such as Directory Readers, Groups Administrator or User Administrator. No extra licence is needed: group management is part of Microsoft Entra ID Free, which comes with Microsoft 365. The PowerShell example requests GroupMember.Read.All; your organisation may require administrator consent.

Know what the list covers. The examples leave out the groups whose owners Microsoft Graph does not hold. Microsoft Graph v1.0 does not yet list service principals as group owners, so a group owned only by an app can appear. A very recent change can take a brief delay to show. The examples read groups and export them; they do not change any group or owner.

Option 1

Find groups without owners with PowerShell

Install the modules once, then connect and export the groups with no owner. The owner count filter runs in Microsoft Graph, so only ownerless groups come back.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Groups -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'GroupMember.Read.All' -NoWelcome
try {
    # A filter on a count is an advanced query: it needs ConsistencyLevel and a count.
    $query = @{
        Filter           = 'owners/$count eq 0'
        ConsistencyLevel = 'eventual'
        CountVariable    = 'ownerlessCount'
        Property         = 'Id', 'DisplayName', 'GroupTypes', 'MailEnabled',
            'OnPremisesSyncEnabled', 'ResourceProvisioningOptions', 'CreatedDateTime'
    }
    $groups = @(Get-MgGroup -All @query)
    # Microsoft Graph holds no owners for distribution, mail-enabled security or synced groups.
    $cloud = @($groups | Where-Object {
        ($_.GroupTypes -contains 'Unified' -or -not $_.MailEnabled) -and
        $_.OnPremisesSyncEnabled -ne $true
    })
    $report = @($cloud | Sort-Object DisplayName | ForEach-Object {
        $unified = $_.GroupTypes -contains 'Unified'
        [pscustomobject]@{
            Group   = $_.DisplayName
            Type    = if ($unified) { 'Microsoft 365' } else { 'Security' }
            Team    = $_.ResourceProvisioningOptions -contains 'Team'
            Dynamic = $_.GroupTypes -contains 'DynamicMembership'
            Created = $_.CreatedDateTime
            Id      = $_.Id
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'Every Microsoft 365 and security group has at least 1 owner.'
    } else {
        $report | Export-Csv -Path './groups-without-owners.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) Microsoft 365 and security groups have no owner."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The script keeps Microsoft 365 groups and security groups made in the cloud, and marks the ones behind a team. Created is in UTC. A group with 1 owner is 1 departure away from none: change the filter to owners/$count eq 1 to list those instead.

Check a single group

Reconnect with Connect-MgGraph, then count 1 group's owners. The main export above disconnects when it finishes.

# Run while connected to Microsoft Graph. Replace the example group name.
$group = @(Get-MgGroup -Filter "displayName eq 'Contoso Sales'")
if ($group.Count -ne 1) { throw "Found $($group.Count) groups with that name; use its ID." }
$owners = @(Get-MgGroupOwner -GroupId $group[0].Id -All)
Write-Output "$($group[0].DisplayName) has $($owners.Count) owners."
foreach ($owner in $owners) {
    [pscustomobject]@{ Id = $owner.Id; Kind = $owner.AdditionalProperties['@odata.type'] }
}

Each owner comes back as a directory object with its ID and kind, such as a user.

Option 2

Review ownerless groups in the admin centre

1. Sign in to the Microsoft 365 admin centre for the correct tenant.
2. Go to Teams & groups > Active teams & groups.
3. Select Filter and choose Ownerless groups. The list shows the Microsoft 365 groups with no owners assigned.
4. Leave the page without assigning an owner or changing anything.
5. For a security group, sign in to the Microsoft Entra admin centre, go to Entra ID > Groups > All groups, select the group and select Owners.

This suits a quick look at Microsoft 365 groups in a tenant you already have open. For security groups, which the Entra admin centre shows 1 at a time, use PowerShell or a report.

Common questions

Why do distribution groups look ownerless?

Microsoft Graph holds no owners for distribution groups, other groups created in Exchange or synced groups, so their owner count is always 0 and the script leaves them out. Altivane's table leaves out synced, distribution and mail-enabled security groups for the same reason, so every group it lists is one whose owners Microsoft Graph holds.

Does this find teams without owners?

Yes. Every team is a Microsoft 365 group, so a team with no owner is in the list, marked in the Team column. For each team's owners and the teams with only 1 owner, see how to find teams without owners.

Why does the filter return an error?

A filter on the owner count is an advanced query. Microsoft Graph accepts it only with ConsistencyLevel set to eventual and a count requested, which the script's -ConsistencyLevel and -CountVariable settings do. If both are in place, check that the account has consented to GroupMember.Read.All.