Disabling the creation of Office 365 Groups and Microsoft Teams
One of the significant governance challenges in Microsoft 365 is that everyone can create Microsoft 365 Groups, Microsoft Teams and Modern SharePoint Sites. In a previous post, we detailed the different creation setting for Classic and Modern SharePoint Sites. While these options disable creation through certain interfaces, they do not stop the creation of Microsoft 365 Groups. Users will still be able to create a Group through Outlook, Planner or as a result of creating a Microsoft Team.
Until now the only way to manage who can create Microsoft 365 Groups and Microsoft Teams was through a complex set of PowerShell scripts. For many organisations running PowerShell scripts in Microsoft 365 requires a complex change process or assistance from their support partner. Instead by enabling what we call “ProvisionPoint Mode” it is quick and easy to manage who can create Microsoft 365 Groups and Teams.
Why restrict Microsoft 365 Group creation?
Many organisations look to restrict who can create Microsoft 365 Groups and Microsoft Teams because of concerns about multiple objects being created for similar purposes. Further, IT departments are concerned about the volume of AD Objects and Exchange mailboxes created as a result of Group creation.
Using a service like ProvisionPoint 365 enables User Self-Service provisioning of Microsoft 365 Groups with options to apply organisational templates and implement approval processes. However to gain maximum benefit of a provisioning and governance service, organisations will want to disable other mechanisms for creating Groups and Teams.
How to restrict Microsoft 365 Group creation
The first step of restricting who can create Microsoft 365 Groups is to decide who can create Groups. Typically group creation is limited to just administrators, which is the approach frequently used with ProvisionPoint 365. Next, you need to create an Active Directory security group to manage who can create Microsoft 365 Groups. For the example of this post, I am using a security group called PPAdmins.
It is straightforward to restrict Group creation to just this active directory within the ProvisionPoint 365 app. In the Group Settings tab, an administrator of ProvisionPoint 365 sets the option to “Allow everyone to create Groups” to No. Then this administrator is able to specify the Active Directory group which can create Groups.
ProvisionPoint Mode is really that simple to enable and will take less than 10 seconds to configure. Far less time than having to research necessary PowerShell scripts and go through an authorisation process to run the script. It is important to recognise, as detailed by Microsoft, that there is a licensing requirement for the users who are still able to create Groups once this process has been completed.
The result for a User
In Outlook the user will still see Microsoft 365 Groups, but there will no longer be an option to create new Groups.
It is important to recognise that disabling Group creation is only one part of a governance solution for Microsoft 365. Users require an alternative method to create Microsoft 365 Groups and Microsoft Teams, otherwise they will become quickly disengaged. Fortunately, ProvisionPoint 365 is the complete provisioning and governance solution for Microsoft 365. By enabling ProvisionPoint Mode, you are empowering user self-service with a selection of templates a user can request to create Microsoft 365 Groups, SharePoint Sites and Microsoft Teams.
Get in contact if you would like a demo of how ProvisionPoint 365 empowers user-self-service while delivering organisational governance.