Archive, Restore & Access Reviews
Teams don't last forever. Learn how to archive completed projects, restore accidentally deleted teams, and use Entra ID access reviews to keep membership current.
Managing the end of a team’s life
Think of teams like projects on a whiteboard.
When a project finishes, you don’t erase the whiteboard immediately — you might need to refer back to it. Archiving is like taking a photo of the whiteboard and locking the room — everything is preserved and readable, but nobody can write on it.
Deleting is erasing the whiteboard and returning the room key. But for 30 days, facilities can recover it from the bin. After that, it’s gone forever.
Access reviews are like a quarterly check: “Does everyone with a room key still need it?” If someone changed departments, their access gets removed automatically.
Archive, unarchive, and delete
| Feature | What Happens | Content | How to Do It |
|---|---|---|---|
| Archive | Team becomes read-only — no new messages, replies, or file uploads. Existing content fully preserved. | All messages, files, wiki, tabs preserved. SharePoint site optionally made read-only too. | Teams admin center, Teams client (team owners), PowerShell: Set-TeamArchivedState |
| Unarchive | Team returns to full read-write. All content still there. | Everything restored to active state. SharePoint site returns to read-write. | Teams admin center, Teams client, PowerShell: Set-TeamArchivedState -Archived $false |
| Delete | Team and underlying M365 Group soft-deleted. 30-day recovery window. | Content accessible for 30 days via recovery. After 30 days, permanently deleted. | Teams admin center, Teams client, PowerShell: Remove-Team |
When to archive vs. delete
| Scenario | Action | Why |
|---|---|---|
| Project completed — may need reference later | Archive | Content preserved, read-only, can unarchive if needed |
| Team created by mistake (wrong name, duplicate) | Delete | No useful content to preserve |
| Regulatory hold — content must be preserved for 7 years | Archive + Retention policy | Archive prevents changes; retention ensures no deletion |
| Employee left — their personal team | Delete | No ongoing business value |
| Semester ended — class team | Let expiration policy handle it | Auto-cleanup based on inactivity |
Scenario: Kofi's end-of-semester cleanup at Harbour University
At the end of each semester, Kofi manages thousands of class teams:
- Research project teams (ongoing multi-year) → leave active
- Completed course teams where faculty want to keep materials → archive (faculty can still read content, students can’t post)
- Short-lived event teams (orientation week, open day) → delete immediately
- Stale teams with no owner response → expiration policy handles automatically (soft-delete after 180 days)
Kofi uses PowerShell to bulk-archive completed course teams:
Get-Team -GroupId $groupIds | ForEach-Object { Set-TeamArchivedState -GroupId $_.GroupId -Archived $true }Restoring deleted teams
When a team is deleted, the underlying M365 Group enters a 30-day soft-delete state. During this window:
Restoration methods
| Method | Who Can Do It | Steps |
|---|---|---|
| Entra ID admin center | Global Admin, Groups Admin | Entra → Groups → Deleted groups → Select group → Restore |
| PowerShell | Admin with appropriate role | Restore-MgDirectoryDeletedItem -DirectoryObjectId group-id |
| Microsoft Graph | Admin via API | POST /directory/deletedItems/group-id/restore |
| Microsoft 365 admin center | Global Admin | Groups → Deleted groups → Restore |
What gets restored
- Team membership and settings
- All channels and channel content
- SharePoint site and all files
- Planner plans and tasks
- OneNote notebooks
- Team apps and tabs
Exam point: Restoration must happen within 30 days of deletion. After 30 days, the group and ALL associated content are permanently deleted and cannot be recovered.
Troubleshooting deleted groups
Common issues when restoring:
| Issue | Cause | Fix |
|---|---|---|
| Group not found in deleted items | More than 30 days have passed | Cannot be restored — permanently deleted |
| Restored group but no team | Team was removed but group kept | Re-create the team from the existing group |
| Permission denied | Insufficient admin role | Need Global Admin or Groups Administrator role |
| Naming conflict | A new group was created with the same name | Rename the new group, then restore the old one |
Microsoft Entra access reviews
Access reviews periodically verify that users still need access to teams and groups. They’re configured in Entra ID → Identity Governance → Access reviews.
When to use access reviews
| Scenario | Review Type | Frequency |
|---|---|---|
| Guest access — do external guests still need team access? | Guest members of all teams | Quarterly |
| Sensitive teams — does everyone in “Executive Strategy” still belong? | Members of specific teams | Monthly |
| Privileged roles — do Teams Administrators still need their role? | Role assignments | Quarterly |
| Compliance requirement — regulators require periodic access certification | All teams in scope | As required |
How access reviews work
- Create a review — choose scope (all groups, specific groups, guest users)
- Assign reviewers — team owners, specific managers, or self-review
- Review period starts — reviewers get email with a list of members to approve or deny
- Reviewers respond — approve (keep access) or deny (remove access) for each member
- Auto-apply results — if configured, denied users are automatically removed
- No response action — if a reviewer doesn’t respond, configure whether to keep or remove access
Scenario: Nadia's guest access review at Sterling Financial
Sterling Financial has 200+ guest users (external auditors, law firms, consultants) across various teams. Regulators require quarterly access certification.
Nadia configures an access review:
- Scope: All guest users across all M365 Groups
- Reviewers: Team owners (each owner reviews their team’s guests)
- Frequency: Every 90 days
- Auto-apply: Yes — denied guests are removed automatically
- No response: Remove access (if an owner doesn’t respond in 14 days, guests are removed by default)
Every quarter, team owners get an email: “Review 3 guest users in your team. Do they still need access?” Owners click Approve or Deny. Guests who are denied are automatically removed from the team within 24 hours.
Licensing for access reviews
- Microsoft Entra ID P2 (or Entra ID Governance licence) required for access reviews
- This is separate from the P1 licence needed for naming/expiration policies
🎬 Video walkthrough
🎬 Video coming soon
Archive, Restore & Access Reviews — MS-700 Module 8
Archive, Restore & Access Reviews — MS-700 Module 8
~9 minFlashcards
Knowledge Check
A project team at Pinnacle Corp has completed their work. Tara wants to preserve all content for future reference but prevent any new messages or file changes. What should she do?
A professor at Harbour University accidentally deleted a class team 35 days ago and now wants the files back. What can Kofi do?
Next up: Guest Access & External Sharing — how to configure guest access, control external sharing, and manage who can collaborate with people outside your organisation.