IN 30 SECONDSFull read: 2 min
- Restrict who can create Microsoft 365 Groups and Teams creation follows automatically.
- Run the whole script: the first block creates the Group.Unified setting if your tenant lacks it.
- It also blocks Planner plans, SharePoint team sites and anything else that creates a Group.
Teams creation is controlled by Microsoft 365 Group creation under the hood. Restrict who can create M365 Groups and Teams creation follows automatically. The script below applies that restriction tenant-wide and optionally allows a specific security group to bypass it.
The PowerShell script#
Import-Module Microsoft.Graph.Beta.Identity.DirectoryManagement
Import-Module Microsoft.Graph.Beta.Groups
Connect-MgGraph -Scopes "Directory.ReadWrite.All", "Group.Read.All"
# Leave GroupName empty to block all users except Global Admins
$GroupName = ""
$AllowGroupCreation = "False"
$settingsObjectID = (Get-MgBetaDirectorySetting |
Where-Object -Property Displayname -Value "Group.Unified" -EQ).id
if (!$settingsObjectID) {
$params = @{
templateId = "62375ab9-6b52-47ed-826b-58e47e0e304b"
values = @(
@{
name = "EnableMSStandardBlockedWords"
value = $true
}
)
}
New-MgBetaDirectorySetting -BodyParameter $params
$settingsObjectID = (Get-MgBetaDirectorySetting |
Where-Object -Property Displayname -Value "Group.Unified" -EQ).Id
}
$groupId = (Get-MgBetaGroup -All |
Where-Object { $_.displayname -eq $GroupName }).Id
$params = @{
templateId = "62375ab9-6b52-47ed-826b-58e47e0e304b"
values = @(
@{
name = "EnableGroupCreation"
value = $AllowGroupCreation
}
@{
name = "GroupCreationAllowedGroupId"
value = $groupId
}
)
}
Update-MgBetaDirectorySetting -DirectorySettingId $settingsObjectID -BodyParameter $params
# Confirm the applied values
(Get-MgBetaDirectorySetting -DirectorySettingId $settingsObjectID).ValuesBefore you run this#
Before you run this
0 of 4 doneMicrosoft reference: Manage who can create Microsoft 365 Groups, at learn.microsoft.com/en-us/microsoft-365/solutions/manage-creation-of-groups
Rather have us do it for you?
A free 15-minute call. We look at your tenant and tell you what to fix first.
Book a Free CallWRITTEN BY
MStack360 Team
The MStack360 team delivers Microsoft 365 migrations, security and Power Platform projects for businesses across North America, Europe, Australia and the Middle East.