Restrict Groups Creation in Office 365

- July 10, 2018

Restrict Groups Creation in Office 365

How to disable the ability to create groups in all Office 365 services that use groups:

· Outlook

· SharePoint

· Yammer

· Microsoft Teams:
Both admins and users won't be able to create teams

· StaffHub
Both admins and managers won't be able to create teams

· Planner
Users won't be able to create a new plan in Planner web and mobile apps

· PowerBI

The best way to do this is to create a security group, and then only the people in that security group will be able to create Office 365 Groups and teams in these apps.

NOTE:
You should verify your impact to Microsoft Teams. The creation of Teams, which go along with a Groups365 creation might impact the work efficiency of your users.

Note:
Groups can have an "end date", where the group will automatically be deleted.

However, restricting group creation will not prevent the listed members from creating Office 365 Groups from the apps and it prevents other users from creating teams (because you can't create teams in the Office 365 admin center).

· Office 365 Global admins

· Mailbox Administrator

· Partner Tier1 Support

· Partner Tier2 Support

· Directory Writers

Setting Set-MSOLCompanySettings -UsersPermissionToCreateGroupsEnabled $True only enables permissions for users to create Security groups, not Office 365 groups.

Start: Login to Office 365 and Activate AzureAD Module

Verify if the correct AzureAD Module is installed

Get-InstalledModule -Name "AzureAD*"
Uninstall-Module AzureADPreview or Uninstall-Module AzureAD

IMPORTANT:
You cannot install both the preview and GA versions on the same computer at the same time.

Set-ExecutionPolicy RemoteSigned
$credential = Get-Credential
Connect-MsolService -Credential $credential
Install-Module AzureADPreview

Step 1: Create a security group for users who need to create Office 365 Groups

Create a Group in Office 365 Users & Groups and name the Group as you require by your naming convention.

Step 2: Run PowerShell commands

Import-Module AzureADPreview
Connect-AzureAD
Get-AzureADGroup -SearchString "<Name of your security group>"
$Template = Get-AzureADDirectorySettingTemplate | where {$_.DisplayName -eq 'Group.Unified'}
$Setting = $Template.CreateDirectorySetting()
New-AzureADDirectorySetting -DirectorySetting $Setting
$Setting = Get-AzureADDirectorySetting -Id (Get-AzureADDirectorySetting | where -Property DisplayName -Value "Group.Unified" -EQ).id
$Setting["EnableGroupCreation"] = $False
$Setting["GroupCreationAllowedGroupId"] = (Get-AzureADGroup -SearchString "<Name of your security group>").objectid
Set-AzureADDirectorySetting -Id (Get-AzureADDirectorySetting | where -Property DisplayName -Value "Group.Unified" -EQ).id -DirectorySetting $Setting
(Get-AzureADDirectorySetting).Values