How to Restrict Microsoft Teams and Microsoft 365 Groups Creation

By Microsoft MVP and MCT · Pluralsight Author

Published November 14, 2023 · Updated January 15, 2026 · Microsoft 365, Microsoft Teams

An integral part of managing Microsoft Teams and Microsoft 365 Groups is restricting who can and can’t create them. Watch for a demo on how you can restrict access!

Full Course

Video Summary

Here are the key points from the video:

  • Restricting group creation helps manage and control the creation of Microsoft 365 groups, preventing duplication and inactive groups.
  • First, create a new security group or Microsoft 365 group and add members who are allowed to create groups.
  • This configuration is done via PowerShell, not through the user interface, and it may take 24-36 hours to take effect.
  • Ensure there’s no existing Active Directory setting object before creating a new one. Use specific PowerShell cmdlets to check and create settings.
  • Users without permission won’t see the option to create groups, ensuring a streamlined experience. This restriction can be useful for organizations to control group creation based on training or employment status.

For more information, read the transcript blog below, or watch the video above!

Video Transcript

Next up, let’s learn how we can restrict who can create Microsoft 365 groups inside your tenant. By default, everyone in your tenant can create Microsoft 365 groups. However, we can configure it to only allow select users to create a group inside your tenant. By reducing the number of people who can create groups, you can train the super users in your organization to understand the groups concept and reduce the chance of group duplication or inactive groups. Configured users that do not have the permission will not even see the option inside the user interface, so it’s quite well implemented from a user experience point of view.

Before we start configuring, the first thing you will have to do is to create a new security group or a Microsoft 365 group, which we will use to basically say this is the group that is allowed to create Microsoft 365 groups inside the organization. After you create it, make sure you add all the members that will be allowed to create a Microsoft 365 group inside. This configuration can only be done via PowerShell, so there is no user interface option for this one. Similar to the other settings we have seen so far, it might take 24 to 36 hours until this setting is reflected for all of the users inside the interface.

Now that we know the setting, let’s learn how to configure the group creation restriction. This setting is done via an Active Directory setting object. The first thing we will have to do is to make sure we have our Azure Active Directory setting object, and we will have to create it. But before you go creating it, make sure that there isn’t one that already exists because another admin might have already created one, or even maybe yourself for another setting a while ago and you forgot about it. To verify if there’s already an existing Active Directory setting object and if yes, the configurations inside, we will use the Get-MgBetaDirectorySetting PowerShell cmdlet and we will filter where the display name is “Group.Unified” and we will save it all in a variable called “setting.” We will then check the values of the setting variable. If we see values, it means we already have an AD setting object and we can just modify that one. But if nothing is returned, it just means there is no Active Directory setting object, so we have to create our own.

If we need to create one, we need to first run the Get-MgBetaDirectorySettingTemplate and filter where the display name is “Group.Unified” and we will save it all inside a variable called “settingTemplate.” We will then run the New-MgBetaDirectorySetting PowerShell cmdlet and give it a template ID, which will be the ID of the template. We will first run a Get-MgGroup cmdlet to get our group and especially the ID of our group, and afterwards, we can start creating the group creation restriction. To configure it, we will create again a hash table, but this time we will have two values inside. First of all, “EnableGroupCreation,” which we need to set to false. If we only configure this setting without the second, we are completely turning off group creation inside the tenant. But then we have a second setting called “GroupCreationAllowedGroupId,” in which we say except for the members of this group. So basically, we’re saying group creation is turned off for everybody except the members part of this group, and here is the ID of the group. We will then update the settings exactly like we have done in the past examples from this module.

Now that we know the theory, let’s go to the lab and restrict who can create Microsoft 365 groups. We’re now in the lab environment, and first of all, let me open up the browser here where I’m in the intro admin center. As you can see, I do have a Microsoft 365 group called “Microsoft 365 Group Creators.” Right now, it has two members inside: John Smith and Vlad Katrinescu. So this is my group. Then let’s go to PowerShell. The first thing I will do is I will run a Get-MgGroup and filter on that group name. What I will need is basically the ID of the group here, which is b1d31e97 and so on. Then if we take a look at the setting values from our AD directory object setting that we talked about before, we do have two different properties that we will modify. First of all, “EnableGroupCreation,” so we will set that to false. Then we have the “GroupCreationAllowedGroupId.” Right now, it’s empty, but we will set it to the ID of the group that we just showed. Let me create this PowerShell object here. It did not copy-paste the right thing. Let me try again. There we go. Then I will get my setting again just in case, and run Update-MgBetaDirectorySetting like we have done in the previous examples. If we double-check that everything got configured properly, let’s go in the setting values and you will notice that “EnableGroupCreation” is now false and I do have the group ID in here. Now again, this is one of those where we’re going to have to wait 24, I even think 36 hours, before it fully takes effect across all applications. I’ll stop the recording now but we’ll be back in just a few seconds for you so you can see the result.

We have now seen how to do it and we give it 24 hours to make sure it applies. So now let’s go in the lab and take a look at what it looks like when a user is not in the allowed group to create Microsoft 365 groups. We’re back in the lab environment. First of all, I will open Teams up as Vlad. You’ll notice I have the option to create a team or join a team with a code, and I can create a team which will create a Microsoft 365 group. If I go to the browser here again as Vlad, I have in my Outlook on the web, I have the option to create a new group or even go under new mail here and I have the group option. However, if I now log in as Vanessa Lee, and Vanessa was not a member of the group that’s allowed to create Microsoft 365 groups, when I go to join or create a team, I do not have the option to create a brand new team. Now just so you know, if a user is an owner of a Microsoft 365 group that doesn’t have a team, they will see the option here. Why? Because the restriction is really we’re not allowing users to create new Microsoft 365 groups, but we allow them to create new teams for existing groups. So just so we make sure we understand the difference. But right now, since I’m not the owner of any groups without a team attached, I do not see it in here. If I go to Outlook, if I go under new mail here, you see I do not have the group option. Under my groups here on the left, I do not have a new group. I have manage groups, discover groups, but I do not see new group. So this is the user experience when a user is not allowed to create a Microsoft 365 group. They will not see the option in the user interface. That is a truly great experience in my opinion and something that many organizations I work with are implementing to make sure that maybe only users that passed a certain level of training can create groups or users that are full-time employees or work from the main office are the only ones allowed to create groups. This is it for this demo. Let’s head back to the slides and learn about another tool to help us with our group’s governance.