2 minutes reading time (397 words)

Stop users from being able to create Microsoft Teams

How to block users from being able to create Teams by restricting who can create Microsoft 365 groups using PowerShell Set-AzureADDirectorySetting

  • Teams use Microsoft 365 groups, and by default all users can create Microsoft 365 groups. 
  • Access to create Teams can be controlled by restricting who can create Microsoft 365 unified groups.  

In the next steps, we will use Azure AD PowerShell to change the Azure AD directory setting to restrict access to create unified groups to a group called "Teams Admins".

Install Azure AD PowerShell Modules

You'll need to install both the Azure AD PowerShell general availability module and the public preview module because the Get-AzureDirectorySetting cmdlet is available in the Azure AD preview module.

# Install Azure AD PowerShell Modules
Install-Module AzureAD
Install-module AzureADPreview -AllowClobber -Force 

Create Azure AD security group for Teams Admins

Users in this group will have permissions to create Teams

# Connect to Azure AD Preview Powershell

# Create Azure AD group
New-AzureADGroup -Description "Members of this group can create Teams" -DisplayName "Teams Admins" -MailEnabled $false -SecurityEnabled $true -MailNickName "teamsadmins"


Get existing group creation settings using PowerShell Get-AzureADDirectorySetting

Before we begin, lets check what the existing settings are for creating M365 groups

# Get Azure AD directory settings for unified groups
$settingsObjectID = (Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
(Get-AzureADDirectorySetting -Id $settingsObjectID).Values 

Change AzureADDirectorySetting to restrict creating Teams

The following PowerShell will restrict creation of Teams to members of the group "Teams Admins"  

$GroupName = "Teams Admins"
$AllowGroupCreation = $False

$settingsObjectID = (Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
    $template = Get-AzureADDirectorySettingTemplate | Where-object {$_.displayname -eq "group.unified"}
    $settingsCopy = $template.CreateDirectorySetting()
    New-AzureADDirectorySetting -DirectorySetting $settingsCopy
    $settingsObjectID = (Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id

$settingsCopy = Get-AzureADDirectorySetting -Id $settingsObjectID
$settingsCopy["EnableGroupCreation"] = $AllowGroupCreation

  $settingsCopy["GroupCreationAllowedGroupId"] = (Get-AzureADGroup -SearchString $GroupName).objectid
} else {
$settingsCopy["GroupCreationAllowedGroupId"] = $GroupName
Set-AzureADDirectorySetting -Id $settingsObjectID -DirectorySetting $settingsCopy

(Get-AzureADDirectorySetting -Id $settingsObjectID).Values 

Check that users can't create Teams

Related Posts



No comments made yet. Be the first to submit a comment
Already Registered? Login Here
Saturday, 23 September 2023
You can help support this website by buying me a coffee!
Buy Me A Coffee