Disable Teams Group Creation With Exception - GroupCreationAllowedGroupId

[Space_Munkey]

Hi All,

 

Not sure if this is the correct area, please move to a more appropriate place if necessary.

 

This is just a little helpful guide for anybody out there who has removed the ability for staff to create Teams and want to set an exception for a 365 security group but cannot get the GroupCreationAllowedGroupId settings value to update.

 

https://learn.microsoft.com/en-us/microsoft-365/solutions/manage-creation-of-groups?view=o365-worldwide

 

On the above page, Microsoft provides a Powershell script that will remove group / teams creation for your tenant and claims to allow for an exception.

 

The script will run fine, but it will not set an exception - This is due to a filter / search function directed to the Graph modules. Search & Filter apparently are illegal / do not work with MgBetaGroup - I think it may be overlooked / changes from the straight swap from AAD

 

The work around is to provide the Security Group's ID and update the settings value directly by doing the following:

 

Import-Module Microsoft.Graph.Beta.Identity.DirectoryManagement
Import-Module Microsoft.Graph.Beta.Groups

Connect-MgGraph -Scopes "Directory.ReadWrite.All", "Group.Read.All"

##$GroupName = "Teams Creators" ----- This is the bit we're bypassing 
$AllowGroupCreation = "False"
$settingsObjectID = (Get-MgBetaDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
if(!$settingsObjectID)
{
$params = @{
templateId = "62375ab9-6b52-47ed-826b-58e47e0e304b"
values = @(
@{
name = "EnableMSStandardBlockedWords"
value = "true"
}
)
}
New-MgBetaDirectorySetting -BodyParameter $params
$settingsObjectID = (Get-MgBetaDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).Id
}

##$groupId = (Get-MgBetaGroup | Where-object {$_.displayname -eq $GroupName}).Id ---- This is the search / filter function that doesn't work!!

$params = @{
templateId = "62375ab9-6b52-47ed-826b-58e47e0e304b"
values = @(
@{
name = "EnableGroupCreation"
value = $AllowGroupCreation
}
@{
name = "GroupCreationAllowedGroupId"
value = "INSERT THE SECURITY GROUPS ID HERE" ##Rather than search for security ID, Just provide it, it's easy enough to find in Azure.
}
)
}
Update-MgBetaDirectorySetting -DirectorySettingId $settingsObjectID -BodyParameter $params
(Get-MgBetaDirectorySetting -DirectorySettingId $settingsObjectID).Values

 

Hope that helps somebody out there - Not much information on it online!

 

Another quick tip is that MS365 needs group creation ENABLED for the exception group to work! - Teams creation will still be disabled for users, thanks to the script.

Edited July 3, 2024 by Space_Munkey

[ricky15100]

Thank you so much for this, ive been banging my head against a wall trying to get this to work.

 

Good work!!!

[Space_Munkey]

😁 I'm glad it helped!