Forum Discussion
What's meaning of the "Show the Create site command to users who have permission to create sites"
- DeletedJan 17, 2018It means users that can create groups can see that button. You can restrict users who can create 365 groups and it piggy backs off that permission. Otherwise you turn it off for everyone.
Hi Tobey, currently the option to 'Create new site' creates two types of sites: (a) Group-based team sites and (b) communication sites. Other SharePoint sites are created in the SharePoint Admin portal.
In our environment, the ability to create new sites from the SharePoint portal 'Create new site' is restricted to the members of a Security Group. (This restriction is done via PS, there is no switch to do this). The ability to create new SharePoint sites from the SharePoint Admin portal is restricted to the SharePoint Admins.
We don't create new Group-based sites using this option, we create a new Office 365 Group which in turn creates the site.
Understanding the centrality of Groups is important. For example, this restriction means that our users cannot create new Teams in MS Teams; instead we link them to an O365 Group. They cannot create a Plan in Planner for a similar reason. We did this deliberately to (a) ensure naming conventions were met for Groups (all of ours start with O365_GRP or O365_PRJ) and (b) prevent the proliferation of both random Groups and related SharePoint sites, and (c) prevent the duplication of SharePoint sites - for example, if the Architecture team in IT created a Team or a SharePoint site called 'Architecture' when a site already exists.
We use the same process (a SharePoint Online list) for users to request both Office 365 Groups and also SharePoint sites. This ensures we maintain consistency and minimise duplication.
- Pawan_SatopeMar 26, 2019Copper Contributor
AndrewWarland Can you share that powershell script to restrict ability to create site to particular security group? Where to run? Any links for reference?
- AndrewWarlandMar 28, 2019Iron Contributor
Hi again Pawan_Satope
Tony Redmond's Office 365 Guide includes the directions to restrict the creation of Groups as outlined below:
- Create either a Security Group for users who will be able to create a group. Maybe name it: O365_GROUPS_Admin
- Add users. These users must have O365 accounts.
- Create (via Powershell) an Azure Active Directory policy to disable group creation to the group just created.
- Retrieve the object identifier (ObjectID) for the authorised group.
- Use Powershell to update the AAD policy
- Run Get-MsolAllSettings - TargetType Gruops | ForEach Values to confirm that 'EnableGroupCreation' is False.
- AndrewWarlandMar 28, 2019Iron Contributor