Northwind Traders

Groups with no members at all. Delete the ones nobody needs; a dynamic group here has a rule that matches nobody. Empty groups older than 30 days are flagged.

Groups with other groups as members. Everyone in the inner groups gets what the outer group gives, which is easy to miss; 3 or more levels are flagged.

Groups whose members Entra ID works out from a rule (needs Entra ID P1). A paused rule stops adding joiners and removing leavers, so it's flagged.

Teams and Microsoft 365 groups the expiration policy will delete within 90 days. One that's used renews itself; otherwise its owners are emailed to renew it, so a group with no owner who can sign in is flagged, as is one due within 30 days. A deleted group can be restored for 30 days.

Groups that can be given admin roles, so being a member of one is being an admin. Their owners can add anyone; a guest in one is flagged.

Groups that still hold accounts whose sign-in is blocked, usually leavers. Access the group gives is handed back the moment the account is unblocked, and the member counts others see are wrong; blocked accounts in a role-assignable group are flagged higher.

Every group in the tenant, with its direct members (people, devices, apps and groups).