o365 stop users creating groups! :(

[chazzy2501]

Damn if I haven't been so annoyed at something... So if you have fix this let me know

 

I want to stop my pupils creating groups in O365..

 

I've done the uncheck the 2 group settings in the default role assignment policy within exchange management... it didn't work. (users can still make groups, this was when I had only 1 role & so didn't have to reapply it)

 

I've now created a second role with no group permissions, applied it to my test pupil... and it can still make groups. WTF gives

[foofighterjim]

Have you tried following: https://support.office.com/en-gb/article/Control-who-can-create-Office-365-Groups-4c46c8cb-17d0-44b5-9776-005fced8e618?ui=en-US&rs=en-GB&ad=GB

 

I'm sure this is what I used.

[CHM-ITServices]

Disable)365Groups.txt

 

I use the attached script. It has been succesful for me.

 

Hope it helps,

[Willott]

@foofighterjim's method is the one I used

@Jam_lane - you'll find that it's still possible for the little darlings to create groups - that's the method I originally had in place

[apearce]

There is a new location where you manage this - the controls above are only for exchange not anywhere groups are created such as Planner.

 

This is now done in Azure AD where the roots of groups are now created. You'll need Azure AD PowerShell V2 and then add users to the AllGroupCreation group to give them permission - you can add groups in to the group should you want.

 

 

Connect-AzureAD

 

New-AzureADGroup -DisplayName "AllowGroupCreation" -MailEnabled $false -SecurityEnabled $true -MailNickName "NotSet"

 

Get-AzureADDirectorySettingTemplate

 

$Template = Get-AzureADDirectorySettingTemplate -Id 62375ab9-6b52-47ed-826b-58e47e0e304b

 

 

$Setting = $template.CreateDirectorySetting()

New-AzureADDirectorySetting -DirectorySetting $setting

$Setting = Get-AzureADDirectorySetting –Id (Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id

 

$Setting["EnableGroupCreation"] = $False

 

$Setting["GroupCreationAllowedGroupId"] = (get-AzureADGroup -SearchString "AllowGroupCreation").objectid

 

Set-AzureADDirectorySetting -Id (Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id -DirectorySetting $Setting

 

 

$setting.values

 

 

 

Would post link to download for powershell but about to jump on a call about this very thing.

Edited May 19, 2017 by apearce