Introduction
Nearly every time Microsoft introduces a solution in Office 365 one of the first thing IT people look for is how to turn it off. The same thing occurred when Office 365 Groups were released to the world. Office 365 Groups are more unique in this situation because they are not really a single technology but more of a solution wrapping multiple technologies within Office 365. There are a lot of other posts out there about what actually makes up Office 365 Groups and I plan to write a much longer one, but here are the basics of what is currently wrapped up:
- Email & Calendar
- Security & Membership
- Files & OneNote
- Planner
- PowerBI
- and more!
One key thing to understand looking at this list is that you have multiple technologies such as Azure AD, Exchange, and SharePoint. When you have multiple technologies you have a harder challenge with centralized management. As Microsoft continues to innovate they will continue to do so using the Minimal Viable Product (MVP) method. This means that we are getting solutions that are not fully developed and one of the most common areas that this is lacking is with IT management. New solutions are people first and personally I like this approach.
What occurred with Office 365 Groups was that until very recently the only way to control Group creation was through Outlook Mailbox Policies via Exchange. This meant that if you created a group via Planner (which Groups are required) or PowerBI it would not follow the policy and the user could still create Groups. This is because the creation is not occurring through an Exchange application and means the OwaMailboxPolicy process doesn’t work anymore.
Managing Group Creation via Azure AD
With the GA of Planner, Microsoft added the ability within Azure AD PowerShell to control who can create Office 365 Groups. This process is no longer dependent on Exchange so it passes throughout Office 365. If an OWA policy exists and Azure AD (AAD) policy is enabled, the OWA policy will be ignored.
You can now do 2 things:
- Disable the default ability of everyone to create a new Office 365 Group
- Point to an AAD group (Office 365 Group or Distribution Group) that contains a list of people who are allowed to create groups
- This group cannot have a group in it, must be individual users
- Users with higher tenant roles already have access (company admin, mailbox admin, etc…)
Prerequisites:
NOTE: Version 1.1.143.0 of the Azure AD PowerShell module includes many changes to renew the existing MSOL PowerShell cmdets. Over time the existing MSOL cmdlets will be replaced. The new module is called “AzureAD.” So where e.g. an existing cmdlet was named “New-MSOLUser”, which adds a new user to the directory, the new cmdlet’s name is “New-AzureADUser.”
My scripts below are using Version 1.1.143.0. Azure AD PowerShell Module Version Release History
Steps to disable ALL Group creation
1 – Connect to Azure AD via PowerShell
Connect-MsolService
2 – Review if you have any MsolSettings currently configured in your tenant
Get-MsolAllSettings | ForEach Values
3a – If you have settings returned it will look like this (properties subject to change over time)
Run this command to set EnableGroupCreation to false and remove any groups entered in GroupCreationAllowedGroupId
$settings = Get-MsolAllSettings | where-object {$_.displayname -eq “Group.Unified”}
$singlesettings = Get-MsolSettings -SettingId $settings.ObjectId
$value = $singlesettings.GetSettingsValue()
$value["EnableGroupCreation"] = "false"
$value["GroupCreationAllowedGroupId"] = ""
Set-MsolSettings -SettingId $settings.ObjectId -SettingsValue $value
3b – If you have NO settings returned it will look like this a new template will need to be created
Run this command to create the new template with EnableGroupCreation set to false
$template = Get-MsolAllSettingTemplate | where-object {$_.displayname -eq “Group.Unified”}
$setting = $template.CreateSettingsObject()
$setting[“EnableGroupCreation”] = “false”
New-MsolSettings –SettingsObject $setting
4 – Review your updated settings; now Group creation is disabled for all users
Get-MsolAllSettings | ForEach Values
Steps to disable Group creation except for only authorized users
1 – Connect to Azure AD via PowerShell
Connect-MsolService
2 – Review if you have any MsolSettings currently configured in your tenant
Get-MsolAllSettings | ForEach Values
3a – If you have settings returned it will look like this (properties subject to change over time)
Run this command to update the settings with EnableGroupCreation set to false and pass the group for authorized users who will be able to create groups.
- Replace “ENTER GROUP DISPLAY NAME HERE” with the display name of your group to get the ObjectId of the group.
$group = Get-MsolGroup -All | Where-Object {$_.DisplayName -eq “ENTER GROUP DISPLAY NAME HERE”}
$settings = Get-MsolAllSettings | where-object {$_.displayname -eq “Group.Unified”}
$singlesettings = Get-MsolSettings -SettingId $settings.ObjectId
$value = $singlesettings.GetSettingsValue()
$value["EnableGroupCreation"] = "false"
$value["GroupCreationAllowedGroupId"] = $group.ObjectId
Set-MsolSettings -SettingId $settings.ObjectId -SettingsValue $value
Here is a visual example of what we are trying to get via the Azure AD portal.
3b – If you have NO settings returned it will look like this a new template will need to be created
Run this command to create the new template with EnableGroupCreation set to false and pass the group for authorized users who will be able to create groups.
- Replace “ENTER GROUP DISPLAY NAME HERE” with the display name of your group to get the ObjectId of the group.
$group = Get-MsolGroup -All | Where-Object {$_.DisplayName -eq “ENTER GROUP DISPLAY NAME HERE”}
$template = Get-MsolAllSettingTemplate | where-object {$_.displayname -eq “Group.Unified”}
$setting = $template.CreateSettingsObject()
$setting[“EnableGroupCreation”] = “false”
$setting[“GroupCreationAllowedGroupId”] = $group.ObjectId
New-MsolSettings –SettingsObject $setting
4 – Review your updated settings; now Group creation is disabled for all users EXCEPT the ones in the declared group
Get-MsolAllSettings | ForEach Values
Aftermath
Once configured users will see errors like this when trying to create an Office 365 Group
Via Outlook UI:
Via Planner UI:
All of these Office 365 Group scripts can be found on Github. Large thanks to Tony Redmond, Santhosh Balakrishnan, and Juan Carlos Martin for providing multiple scripts
Please feel free to contribute!
https://github.com/dmadelung/O365GroupsScripts
Within SharePoint Online you have the ability to completely lock down a site collection so no one can get access to it. This is set via PowerShell and the 
