Disabling Office 365 Groups

Disabling Office 365 Groups

It has been a while since I blogged about How to  disable Office 365 Groups for specific users. Disabling groups can be a valid option to keep a little more control over the creation process. While groups are a great way to share and collaborate there are scenario’s where you do not want users to create them yet.

Disable groups for specific users

In the post  How to  disable Office 365 Groups for specific users. The sample used to disable groups was the following:

New-OwaMailboxPolicy –Name "Group Creation"

Set-OwaMailboxPolicy –Identity "Group Creation" –GroupCreationEnabled $false

Set-CASMailbox –Identity katiej@spevent002.onmicrosoft.com -OWAMailboxPolicy "Group Creation"

While this sample still works it has some side effects. It only disables the group creation process in the UI. By disabling groups that way users can no longer create groups. Yet they still can create planner plans that result in groups.

New group creation policy

With the new group creation policies there you have some more control. Using a setting object you can still set who can create groups and who can't. You can set the GroupCreationAllowedGroupId to a Active Directory group of users who are allowed to create groups and setting the flag to false for everyone else. By disabling groups this way you also disable the creation of plans. This will result in a solution where you cannot 'trick' the system to create groups by creating a plan or team.

Creating a plan results in the following warning:

Group & Plan creation disabled in Planner

Creating a team shows a similar warning:

Group & Plan creation disabled in Teams

Creating a group through the OWA

Group & Plan creation disabled in OWA

A sample to disable groups would be:

$template = Get-MsolAllSettingTemplate | where-object {$_.displayname -eq "Group.Unified"}
$setting = $template.CreateSettingsObject()
$setting["EnableGroupCreation"] = "false"
$setting["GroupCreationAllowedGroupId"] = "<object ID for your group>"
New-MsolSettings -SettingsObject $setting

When you disabled groups using this snippet you get a nice warning when creating a team or plan that it has been disabled

You can find more on Manage Office 365 Group Creation. Specifically Step 3: Configure your Office 365 Group settings in Azure AD PowerShell describes the options to disable groups the correct way.

PowerShell Preview

When trying out the new bits make sure to download the correct version of the Azure Active Directory Connection commandlets. Currently there is a GA and preview version of the bits. Only the Preview offers the Get-MsolAllSettingTemplate, so you need to download and install the preview. If you already installed the GA version you will need to uninstall it before installing t he preview version.

Leave a Reply