Forum Discussion

aarohbits's avatar
Aug 09, 2021
Solved

Unable to restrict Microsoft 365 Groups In Teams

Hi All,   I have a client’s requirement I had to restrict M365 groups and only selected users can create Teams.   I have followed the Microsoft’s step to restrict via PowerShell Manage who can c...
  • aarohbits's avatar
    aarohbits
    Aug 12, 2021

    Hi TonyRedmondadam deltinger  and jcgonzalezmartin 

     

    TonyRedmond I did contact MS Support and issue is resolved.  Here is summary what happened: 

     

    1. In Microsoft call, they were added a different user (Alex) to the group as a Member and Owner as well as. Removed my account (Aroh)  from the RestrictM365Groups

    2.   After re-running the script

     

    $GroupName = "RestrictM365Groups"
    $AllowGroupCreation = $False
    
    Connect-AzureAD
    
    $settingsObjectID = (Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
    if(!$settingsObjectID)
    {
        $template = Get-AzureADDirectorySettingTemplate | Where-object {$_.displayname -eq "group.unified"}
        $settingsCopy = $template.CreateDirectorySetting()
        New-AzureADDirectorySetting -DirectorySetting $settingsCopy
        $settingsObjectID = (Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
    }
    
    $settingsCopy = Get-AzureADDirectorySetting -Id $settingsObjectID
    $settingsCopy["EnableGroupCreation"] = $AllowGroupCreation
    
    if($GroupName)
    {
      $settingsCopy["GroupCreationAllowedGroupId"] = (Get-AzureADGroup -SearchString $GroupName).objectid
    }
     else {
    $settingsCopy["GroupCreationAllowedGroupId"] = $GroupName
    }
    Set-AzureADDirectorySetting -Id $settingsObjectID -DirectorySetting $settingsCopy
    
    (Get-AzureADDirectorySetting -Id $settingsObjectID).Values
    
    
    $Values = Get-AzureADDirectorySetting | ?{$_.DisplayName -eq "Group.Unified"}
    $GroupId = $Values.Values |?{$_.Name -eq "GroupCreationAllowedGroupId" } | Select -ExpandProperty Value
    Write-Host ("The name of the group defined by policy to control group creation is {0} and its object identifier is {1}" -f (Get-AzureADGroup -ObjectId $GroupId).DisplayName, $GroupId)
    Get-AzureADGroupMember -ObjectId $GroupId​


    and waiting a moment, the settings seemed to be working correctly.

     

    • The issue was, that I was owner of the group but there was no member for the RestrictM365Groups security group

    • After adding my name in both in Owner and Member  
    • I can create teams with my account

       


       
    •  Other users cannot create Teams


    • The Microsoft 365 Groups settings at Azure portal has to be turned off.

       

      Thanks a lot for helping and providing your help! 

Resources