How to Disable Office 365 Group Creation using PowerShell?

Requirement: Disable Office 365 Group Creation using PowerShell.

How to Disable Group Creation in Office 365?
Office 365 group is a shared workspace that lets you choose a set of people that you wish to collaborate with a collection of resources such as a shared Outlook inbox, shared calendar, SharePoint document library, Yammer Group,  Planner, PowerBI, OneNote, etc. While many of the organizations are fine with end-users creating groups, and related artifacts, some may prefer to have administrators control the creation and management of groups as part of the governance policies.

By default, end-users can create Groups in Office 365 environment. The process is simple! Create a security group and pass the group name to the PowerShell. Here is how we can disable 365 group creation:

Prerequisites: You need to have AzureADPreview PowerShell module installed. Also, Create an Active Directory security group - with a list of users who should be able to create groups - so that we can restrict Microsoft 365 Group creation rights within that group.

Step 1: Install the Azure AD Preview PowerShell Module:
We need to have the latest AzureADPreview PowerShell module. You can get a list of all installed PowerShell modules by:
Get-module -ListAvailable
To install the Azure AD Preview PowerShell module, Open Windows PowerShell console as Administrator and enter:
Install-Module AzureADPreview

Please note, If you have the AzureAD module installed, You must uninstall it first and then Install AzureADPreview Module.
turn off group creation office 365

Step 2: Create an Active Directory Security Group
We need this security group to restrict the Office 365 group creation to the members within the particular group.
  • Login to Microsoft Admin Center at https://admin.microsoft.com
  • Groups >> Add a Group >> Choose "Security" >> Provide a Name to your group, Say "Office 365 Group Creators" 
    how to disable group creation in office 365
  • Add members to this security group who you want to be able to create groups in your Office 365 tenant.

Step 3: Disable Group Creation in Office 365 using PowerShell
Alright, Once we are ready with the above steps, We should run this PowerShell script to disable Office 365 group creation for all users, except the members of the security group. Set the $GroupName parameter to the group you created and run! You'll be prompted for login - Login as Global administrator.
#Parameter for AD Security Group
$GroupName = "Office 365 Group Creators"

#Connect to Azure AD
Connect-AzureAD

#Get the ID of Allowed AD Group
$GroupID = (Get-AzureADGroup -SearchString $GroupName).ObjectId

#Get the Office 365 Group Creation Settings ID
$GroupCreationSettingsID = (Get-AzureADDirectorySetting | Where-object {$_.Displayname -Eq "Group.Unified"}).Id

#Create Group Creation Settings, If it doesn't exist
If(!$GroupCreationSettingsID)
{
    #Create Settings from Template
    $Template = Get-AzureADDirectorySettingTemplate | Where-Object {$_.DisplayName -eq "Group.Unified"}
    $DirectorySettings = $Template.CreateDirectorySetting()
    New-AzureADDirectorySetting -DirectorySetting $DirectorySettings
    $GroupCreationSettingsID = (Get-AzureADDirectorySetting | Where-object {$_.Displayname -Eq "Group.Unified"}).Id
}

#Apply Settings
$GroupCreationSettings = Get-AzureADDirectorySetting -Id $GroupCreationSettingsID
$GroupCreationSettings["EnableGroupCreation"] = "False"
$GroupCreationSettings["GroupCreationAllowedGroupId"] = $GroupID

#Commit Settings
Set-AzureADDirectorySetting -Id $GroupCreationSettingsID -DirectorySetting $GroupCreationSettings

#Verify Settings
(Get-AzureADDirectorySetting -Id $GroupCreationSettingsID).Values

This disables the default ability of everyone to create a new Office 365 Groups. Please note, These steps will not prevent members of certain Admin roles from creating Office 365 Groups. Say, for instance: Global admins, Exchange Admin, SharePoint Admin, Teams Service Administrator, User Management Administrator can create Office 365 groups irrespective of the above settings from the respective admin center and from other places.

Verify Group Creation Settings Changes
These changes may take some time to reflect. You can verify the new settings from any application. Here, I'm going to use Microsoft Teams.
  • Login to Microsoft Teams as an end-user who is not part of the AD group we've configured >> Click on "Join or Create Team" link in the bottom.
  • You'll get only "Join a Team" tile. Create team tile should be hidden. (However, You'll be allowed to create a new Team from an existing Office 365 Group based on your access rights!)
    disable group creation office 365 powershell
Similarly, If you try to create a group through outlook, You'll get "Sorry, the ability to create groups has been turned off by the person who manages your email"

How do I revert these changes?
Well, just change these two lines in the above script and run it once!
$GroupCreationSettings["EnableGroupCreation"] = "True"
$GroupCreationSettings["GroupCreationAllowedGroupId"] = ""

Microsoft documentation on disabling Office 365 group creation: https://docs.microsoft.com/en-us/microsoft-365/admin/create-groups/manage-creation-of-groups

No comments:

Please Login and comment to get your questions answered!

Powered by Blogger.