custom AzureADDirectorySettingTemplate as default for all groups

[Deleted]

I have a really specific use case I'm trying to solve and I'm just not having any luck searching for the powershell needed (possible graph may be the answer).

I want to create a custom AzureADDirectorySettingTemplate from the default template (Group.Unified), change the following settings; allowtoaddguests = $false, allowgueststoaccessgroups = $false. Then once the custom template is created, set that as the default settings template for all new groups in the tenant.

The reason is that security is requiring us to start with all new groups as guest access completely disabled, then only enable guest access on request. The main workflow we are pushing for guest access is Teams, but obviously SharePoint has use cases as well. Currently the only way I have to solve this is to run a script watching for newly created groups (say each hour), then update those groups to turn the settings off.

update a single group to no guest access
$Template = Get-AzureADDirectorySettingTemplate -Id 62375ab9-6b52-47ed-826b-58e47e0e304b
$Setting = $Template.CreateDirectorySetting()
$Setting["AllowToAddGuests"]=$false
New-AzureADObjectSetting -TargetType Groups -TargetObjectId (ExternalDirectoryObjectId of UnifiedGroup) -DirectorySetting $Setting

This has the undesired affect of having a group be created as non-compliant and remaining that way for up to an hour. Then, of course, if the script fails for some reason, we could end up with a bunch of non-compliant groups.

Has anyone done this in their tenant? Change the default settings for all new unified groups? I'd love to know how! I also reached out to everyone I know at MS, so if I get a response, I'll be sure to share.

This is the best site I've found on the subject, but it doesn't quite cover what I need:
https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-settings-cmdlets

Thanks!

BJ

[#2]

Simply configure it as shown in the article, but with AllowToAddGuests set to $false. This sets the default configuration for any new groups created in the tenant. Then, for any group you want to have Guest enabled for, apply a custom settings template at the group level.

[#3]

And by "in the article", I mean the first section, "create settings at the directory level": https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-settings-cmdlets#c...

[#4]

We did try that and it works to a point. If we set guest access off at the directory level, it does block all guest access. But then when we have specific Teams that we want to allow guest access, there is no way to do that because the directory level setting overrides the group level setting. What we need is granular control of each Team/O365 Group to set guest access on or off. We were hoping the directory level setting would help with this, but it's very much an all or nothing scenario for all groups in the tenant.

[#5]

This works just fine in conjunction with the granular, group-specific template you can apply (the next section in the article).

[#6]

Have you tested this? Because we see the same behaviour as Bj Zale. The directory level setting seems to override the group level setting.

[#7]

It's my understanding that the directory-level block will stop any group owner adding a guest to membership. That was always the intention... a single setting that controlled all groups in the tenant.

Once the AllowToAddGuests setting is set to False at a tenant level, only administrators can add guests to group membership using admin interfaces like PowerShell or the Office 365 Admin Center.