December | 2025 | Liebensraum

Can’t delete a sharepoint site that used to have a group attached to it, but the group has long since been deleted?

Apparently, the sharepoint admin center is unable to handle this scenario, and just throws a “could not be deleted” error. Using fiddler the only extra info I could get was an underlying 500 Internal Server Error Microsoft.Office.Server.Directory.DirectoryObjectNotFoundException was thrown

Obviously that directory object not found means the office 365 group. Fora seem to point to MS support for manual fixes, but since Microsoft Support has rarely been a pleasant experience for me I went over the PS module for SPO and found a MUCH faster fix, hope it also works for you!

start PowerShell 5 (don’t use a newer version until the module supports it)
install-module Microsoft.Online.SharePoint.PowerShell -force -scope currentuser (unless you already have the module installed)
import-module Microsoft.Online.SharePoint.PowerShell
Set-SPOSite -Identity https://xxx.sharepoint.com/sites/xxx -ClearGroupId
Remove-SPOSite -Identity https://xxx.sharepoint.com/sites/xxx -noWait

A customer wanted to know how many hours on average their devices were being used, without modifying their configuration.

This to help target replacements, upgrades, #desks per location, #shared devices per location etc.

At first I figured it’d be a simple task, just getting the right event ID’s from the local eventlog, but no, that required additional auditing to be enabled and how would the data flow to PowerBI?

The next attempted data source was much better; Defender Advanced Hunting. Especially the DeviceLogonEvents table, which contains cached and interactive logons to all monitored devices.

Using logon events, we can get an idea of a device’s relative use in the fleet. It won’t be exact as measuring the time between pure lock/unlock/signin/signout events.

This was fine for the customer’s purpose and checking their data the number of daily logon events (7-9) was actually much higher than the expected 2-3 per device per day (at least on Windows 11, our target OS).

Getting that data into PowerBI turned out to be even easier 🙂

Option 1: use my PowerBI template

Option 2: build your own report using below steps:

Open up PowerBI and click Blank Query

Open the Advanced Editor

Paste the KQL query and click done

KQL:

 let
        AdvancedHuntingQuery = "DeviceLogonEvents
| where Timestamp between (ago(28d) .. now())
| where ActionType == ""LogonSuccess""
| where LogonType == ""Interactive""
| extend LogonDate = startofday(Timestamp)
| where LogonDate &lt; startofday(now())  
| summarize 
    FirstLogon = min(Timestamp), 
    LastLogon = max(Timestamp)
    by DeviceName, LogonDate
| extend UsageDuration = LastLogon - FirstLogon
| project DeviceName, LogonDate, FirstLogon, LastLogon, UsageDuration
| order by DeviceName asc, LogonDate desc",

        HuntingUrl = "https://api.security.microsoft.com/api/advancedqueries",

        Response = Json.Document(Web.Contents(HuntingUrl, [Query=[key=AdvancedHuntingQuery]])),

        TypeMap = #table(
            { "Type", "PowerBiType" },
            {
                { "Double",   Double.Type },
                { "Int64",    Int64.Type },
                { "Int32",    Int32.Type },
                { "Int16",    Int16.Type },
                { "UInt64",   Number.Type },
                { "UInt32",   Number.Type },
                { "UInt16",   Number.Type },
                { "Byte",     Byte.Type },
                { "Single",   Single.Type },
                { "Decimal",  Decimal.Type },
                { "TimeSpan", Duration.Type },
                { "DateTime", DateTimeZone.Type },
                { "String",   Text.Type },
                { "Boolean",  Logical.Type },
                { "SByte",    Logical.Type },
                { "Guid",     Text.Type }
            }),

        Schema = Table.FromRecords(Response[Schema]),
        TypedSchema = Table.Join(Table.SelectColumns(Schema, {"Name", "Type"}), {"Type"}, TypeMap , {"Type"}),
        Results = Response[Results],
        Rows = Table.FromRecords(Results, Schema[Name]),
        Table = Table.TransformColumnTypes(Rows, Table.ToList(TypedSchema, (c) => {c{0}, c{2}}))

    in Table