Restrict Microsoft 365 group creation to an approved group

Description

Microsoft 365 group creation (which also creates Teams teams, SharePoint team sites and Planner plans) is limited to administrators and to the members of the security group {{ group_creators_group }}:

• the Group.Unified directory setting has EnableGroupCreation = false and GroupCreationAllowedGroupId = the object ID of that group;
• the Entra setting Users can create Microsoft 365 groups in Azure portals, API or PowerShell is No.

Rationale

Open group creation produces many workspaces without a clear owner, purpose or classification, each with its own guest access and sharing. Limiting creation to a trained group, or to a request process, keeps workspaces governed and makes labels, naming and expiration policies effective.

Impact

Users who are not in the group request new teams through a form or the service desk. The members of the allowed group need a Microsoft Entra ID P1 license. The Entra portal toggle alone only covers the Azure and Entra portals, API and PowerShell; the directory setting also covers Outlook, Teams, SharePoint and Planner.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader. Browse to Entra ID > Groups > General and read Users can create Microsoft 365 groups in Azure portals, API or PowerShell.
2. Connect to Microsoft Graph PowerShell (scope Directory.Read.All) and run:

   (Get-MgBetaDirectorySetting | Where-Object DisplayName -eq 'Group.Unified').Values |
     Where-Object Name -in 'EnableGroupCreation','GroupCreationAllowedGroupId'
   

   (or GET https://graph.microsoft.com/v1.0/groupSettings).
3. Check that the group ID resolves to {{ group_creators_group }} with Get-MgGroup -GroupId <id>.
4. Fail if the portal setting is Yes, if no Group.Unified setting exists, if EnableGroupCreation is true, or if GroupCreationAllowedGroupId is empty or points to another group.

Remediation

1. Create the security group {{ group_creators_group }} and add the authorized creators.
2. Connect to Microsoft Graph PowerShell as at least a Groups Administrator (scopes Directory.ReadWrite.All, Group.Read.All).
3. If no Group.Unified setting exists, create it from the template:

   $tpl = Get-MgBetaDirectorySettingTemplate | Where-Object DisplayName -eq 'Group.Unified'
   New-MgBetaDirectorySetting -BodyParameter @{ templateId = $tpl.Id; values = @() }
   

4. Set the values:

   $gid = (Get-MgGroup -Filter "displayName eq '{{ group_creators_group }}'").Id
   $s = Get-MgBetaDirectorySetting | Where-Object DisplayName -eq 'Group.Unified'
   $v = $s.Values
   ($v | Where-Object Name -eq 'EnableGroupCreation').Value = 'false'
   ($v | Where-Object Name -eq 'GroupCreationAllowedGroupId').Value = $gid
   Update-MgBetaDirectorySetting -DirectorySettingId $s.Id -Values $v
   

5. In the Entra admin center, set Users can create Microsoft 365 groups in Azure portals, API or PowerShell to No.

Rollback

Set EnableGroupCreation back to true with Update-MgBetaDirectorySetting.

References

• Manage who can create Microsoft 365 groups Microsoft, vendor-doc, accessed 2026-10-24
• Configure group settings using PowerShell Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-TENANT-003 Restrict security group creation to administrators
• related CB-M365-TENANT-007 Allow public Microsoft 365 groups only when approved
• related CB-M365-TENANT-008 Apply expiration and naming policies to Microsoft 365 groups

People and lifecycle