Nov 22 2017 09:45 PM
Nov 22 2017 09:45 PM
We have the requirement to restrict creation of Office 365 Groups to only a number of people, and we have implemented for described in this article to achieve that:
Within OWA/Outlook we can see the configured policies are correctly followed: a user that is member of the allowed security group can create a new O365 Group, independently from its role.
This means that if a Global Admin user isn't part of the security group, it won't be allowed to create new Groups via UI.
When loading a EXO PowerShell session these policies aren't respected: only users with Global Admin role will get, and be able to execute, the cmdlet New-UnifiedGroup.
A user that is member of the security group allowed to create new Groups, won't get the New-UnifiedGroup command available, despite that user is allowed to perform the operation.
We find this inconvenient, and this won't let us to design and implement a Groups provisioning and governance solution as we expected, following 'least privileges' principle.
We'd like to know if this incorrect behavior is known to Microsoft, and if it'll be addressed in the upcoming future.
Nov 23 2017 12:37 AMSolution
The policy applies to "client" endpoints, PowerShell is not such. You can however create/assign a custom role to any users you want to be able to create Groups via PowerShell. For example, the "Mail Recipients" role already has the New-UnifiedGroup cmdlet.
Nov 23 2017 11:28 PM
Thanks for your answer. Unfortunately this still won't let us achieving our requirement to control by applying it to a security group.
Add-AzureADDirectoryRoleMember : Error occurred while executing AddDirectoryRoleMember Code: Request_BadRequest Message: Role membership changes can only contain objects of the following types: 'ServicePrincipal,User'.
So we'll have to create an Application (service principal) and delegate the operations to it, or assign the permissions per-user.
Nov 24 2017 12:41 AM
Those are the Exchange roles, not the Azure AD ones. You will find them under O365 Admin portal -> Exchange -> Permissions.
Nov 24 2017 03:54 AM
Thanks, that seems to do the trick.
For the record, seems that:
- following permissions are needed for allowing group creation
- still with this it isn't possible to assign that to a security group, but just to specific users
Do you know if this last one is maybe just a limitation in the UI? And what are the cmdlets to perform this operation via PowerShell? (if you know)
Nov 24 2017 10:51 AM
You can assign groups, but they need to be mail-enabled security groups.