M365 Admins

AzureMicrosoft 365

Restrict Microsoft 365/Azure Group Creation

Updated 4 min read

In this post
  1. Microsoft.Graph.Beta module
  2. Create group creator security group
  3. Create directory setting object
  4. Update directory setting object to limit group creation
  5. AzureADPreview module
  6. Create group creator security group
  7. Create directory setting object
  8. Update directory setting object to limit group creation

If you haven’t worked with Microsoft 365 groups yet, they’re great at allowing users to collaborate. The groups themselves consist of a shared mailbox, calendar, SharePoint site and an optional Team. Microsoft’s recommendation is to leave the default access enabled, which allows all users to create Microsoft 365 groups, in the name of collaboration. While you might think leaving this default would be a great idea, I will have to disagree.

By leaving the default, you are allowing users to create shared mailboxes, SharePoint sites and Teams at any time. What you end up with is the following:

  • Large number of groups which become inactive, abandoned or obsolete.
  • Duplicate groups that are created by different users.
  • SharePoint sites containing files that stick around without any active memberships.

This group sprawl becomes difficult to manage and time consuming to clean up.

  • PowerShell (MgGraph)
  • PowerShell (AzureAD)
  • GUI (Azure Portal)

Microsoft.Graph.Beta module

In order to make these changes using Graph, you’ll have to use their beta module.

# Install the Microsoft.Graph.Beta module
Install-Module -Name Microsoft.Graph.Beta

# If already install, update the Microsoft.Graph.Beta module to latest version
Update-Module -Name Microsoft.Graph.Beta

# Connect to MgGraph with necessary permissions
Connect-MgGraph -Scopes "Group.ReadWrite.All,Directory.ReadWrite.All"

Create group creator security group

Create a security group which will contain users that will be allowed to create groups for your tenant.

NOTE: Members of this group will require Microsoft Entra ID P1 or P2 license.

# Create new security group for group creators
New-MgGroup -DisplayName "GroupCreators" -Description "Group members allowed to create groups." -MailEnabled:$false -MailNickName "GroupCreators" -SecurityEnabled:$true

Create directory setting object

Create a new Azure AD (Entra ID) directory setting object. By default, every tenant will use Microsoft’s default settings which allows group creation by any user. In order to set custom settings, you’ll have to create a new directory setting object by copying their setting template.

# Checking if an there's an existing Group.Unified directory setting
$setting = Get-MgBetaDirectorySetting | Where-Object { $_.DisplayName -eq "Group.Unified" }

if (!$setting) {
    # Find the Group.Unified setting template
    $template = Get-MgBetaDirectorySettingTemplate | Where-Object { $_.DisplayName -eq "Group.Unified" }

    # Creates setting object
    New-MgBetaDirectorySetting -TemplateId $template.Id
}

Update directory setting object to limit group creation

Once you create a new directory setting object OR one already exists, you’ll modify the EnableGroupCreation and GroupCreationAllowedGroupId properties.

  • EnableGroupCreation: Default: True. Controls whether users are allowed to create groups.
  • GroupCreationAllowedGroupId: Default: null. Specifies the security group’s ID whose member’s are allowed to create groups.
# Get the Group.Unified directory setting
$setting = Get-MgBetaDirectorySetting | Where-Object { $_.DisplayName -eq "Group.Unified" }

# Set EnableGroupCreation property to disable group creation
($setting.Values | Where-Object { $_.Name -eq "EnableGroupCreation"} ).Value = $false

# Set GroupCreationAllowedGroupId property to allow group creation for group members
($setting.Values | Where-Object { $_.Name -eq "GroupCreationAllowedGroupId"} ).Value = (Get-MgGroup -Filter "DisplayName eq 'GroupCreators'").Id

# Updates directory setting object
Update-MgBetaDirectorySetting -DirectorySettingId $setting.Id -Values $setting.Values

AzureADPreview module

If you prefer the Azure AD Graph modules, you will have to use the AzureADPreview version.

NOTE: The AzureADPreview module will be deprecated in March 2024.

# Install the Azure AD PowerShell for Graph (AzureAD) Preview module
Install-Module -Name AzureADPreview -AllowClobber

# If already installed, update the Azure AD PowerShell for Graph (AzureAD) Preview module to the latest versoin
Update-Module -Name AzureADPreview

# Connect to the Azure AD PowerShell for Graph Preview
AzureADPreview\Connect-AzureAD

Create group creator security group

Create a security group which will contain users that will be allowed to create groups for your tenant.

NOTE: Members of this group will require Microsoft Entra ID P1 or P2 license.

# Create new security group for group creators
New-AzureADGroup -DisplayName "GroupCreators" -Description "Group members allowed to create groups." -MailEnabled:$false -MailNickName "GroupCreators" -SecurityEnabled:$true

Create directory setting object

Create a new Azure AD (Entra ID) directory setting object. By default, every tenant will use Microsoft’s default settings which allows group creation by any user. In order to set custom settings, you’ll have to create a new directory setting object by copying their setting template.

# Checking if an there's an existing Group.Unified directory setting object
$setting = Get-AzureADDirectorySetting | Where-Object { $_.DisplayName -eq "Group.Unified" }

if (!$setting) {
    # Find the Group.Unified setting template
    $template = Get-AzureADDirectorySettingTemplate | Where-Object { $_.DisplayName -eq "Group.Unified" }
    
    # Creates setting object in Azure AD (Entra ID)
    New-AzureADDirectorySetting -DirectorySetting $template.CreateDirectorySetting()
}

Update directory setting object to limit group creation

Once you create a new directory setting object OR one already exists, you’ll modify the EnableGroupCreation and GroupCreationAllowedGroupId properties.

  • EnableGroupCreation: Default: True. Controls whether users are allowed to create groups.
  • GroupCreationAllowedGroupId: Default: null. Specifies the security group’s ID whose member’s are allowed to create groups.
# Get the Group.Unified directory setting object
$setting = Get-AzureADDirectorySetting | Where-Object { $_.DisplayName -eq "Group.Unified" }

# Set properties restricting group creation
$setting["EnableGroupCreation"] = $false
$setting["GroupCreationAllowedGroupId"] = (Get-AzureADGroup -Filter "DisplayName eq 'GroupCreators'").ObjectId

# Save changes to setting object
Set-AzureADDirectorySetting -Id $setting.Id -DirectorySetting $setting

Unfortunately, Microsoft does not let administrators control group creation through the Azure portal. The only step you’ll be able to complete through the browser is the security group creation. You can accomplish this in the Entra admin center Groups page, https://aka.ms/ad/groups.

Leave a Reply

Your email address will not be published. Required fields are marked *