How to block users from creating SharePoint, Teams and Planners using PowerShell

Locking down the creation of Microsoft 365 SharePoint sites, Teams, and Groups can be a very tool in a tech administrator’s toolbox. There could be several reasons why you might want to block users from creating new Microsoft Teams. Some of the common reasons are:

1. Control over Team creation: If you are an administrator or owner of a Microsoft Teams account, you may want to control who can create new teams in order to maintain consistency and organization across the account.

2. Compliance: In some organizations, there may be compliance or regulatory requirements that restrict who can create new teams. For example, in industries such as finance and healthcare, data privacy laws may require strict control over data access and sharing.

3. Security: Allowing users to create new teams can increase the risk of security breaches, such as unauthorized access to confidential information. By limiting the ability to create new teams, you can better manage the security of your Microsoft Teams account.

4. Resource allocation: Creating new teams can consume resources such as storage and bandwidth. By limiting the ability to create new teams, you can manage these resources more effectively and avoid unnecessary costs.

To help you out we are including a PowerShell script below that will block the creations of groups expect for specified users in a group.

————————————————————————————————-

Note that this script requires the Azure Active Directory PowerShell module. You can install the module by running the following command:

Install–Module AzureAD

Here’s the PowerShell script that blocks the creation of Microsoft 365 groups except for a specified security group (please note you will need to create the group first and add in your desired users).

# Connect to the Microsoft 365 admin center Connect-MsolService

# Specify the security group that should be allowed to create Microsoft 365 groups
$allowedGroup = “Allowed Group Name”

# Get the ID of the allowed security group
$allowedGroupId = (Get-MsolGroup -SearchString $allowedGroup).ObjectId

# Get the settings for group creation in the Microsoft 365 tenant
$settings = Get-AzureADDirectorySetting -Id (Get-AzureADDirectorySetting | Where-Object {$_.DisplayName -eq “Group.Unified”}).Id

# If the settings haven’t been created yet, create them
if (!$settings) {
$template = Get-AzureADDirectorySettingTemplate | Where-Object {$_.DisplayName -eq “Group.Unified”}
$settings = $template.CreateDirectorySetting()
}

# Set the group creation settings to block group creation for all except the allowed security group $settings["EnableGroupCreation"] = $false $settings["GroupCreationAllowedGroupId"] = $allowedGroupId Set-AzureADDirectorySetting -Id $settings.Id -DirectorySetting $settings

Here’s how the script works:

The script connects to the Microsoft 365 admin center using the Connect-MsolService cmdlet.
The script specifies the security group that should be allowed to create Microsoft 365 groups.
The script retrieves the ID of the allowed security group using the Get-MsolGroup cmdlet.
The script retrieves the settings for group creation in the Microsoft 365 tenant using the Get-AzureADDirectorySetting cmdlet.
If the settings haven’t been created yet, the script creates them using the Get-AzureADDirectorySettingTemplate cmdlet and the CreateDirectorySetting() method.
The script sets the EnableGroupCreation setting to $false, which blocks group creation for all users.
The script sets the GroupCreationAllowedGroupId setting to the ID of the allowed security group, which allows members of that group to create groups.
The script saves the updated settings using the Set-AzureADDirectorySetting cmdlet.