PowerShell doesn't follow configured policies for Groups creation

[Massimo Prota]

We have the requirement to restrict creation of Office 365 Groups to only a number of people, and we have implemented for described in this article to achieve that:

Manage who can create Office 365 Groups

Within OWA/Outlook we can see the configured policies are correctly followed: a user that is member of the allowed security group can create a new O365 Group, independently from its role.

This means that if a Global Admin user isn't part of the security group, it won't be allowed to create new Groups via UI.

When loading a EXO PowerShell session these policies aren't respected: only users with Global Admin role will get, and be able to execute, the cmdlet New-UnifiedGroup.

A user that is member of the security group allowed to create new Groups, won't get the New-UnifiedGroup command available, despite that user is allowed to perform the operation.

We find this inconvenient, and this won't let us to design and implement a Groups provisioning and governance solution as we expected, following 'least privileges' principle.

We'd like to know if this incorrect behavior is known to Microsoft, and if it'll be addressed in the upcoming future.

Regards,

Massimo

[#2 · Accepted solution]

The policy applies to "client" endpoints, PowerShell is not such. You can however create/assign a custom role to any users you want to be able to create Groups via PowerShell. For example, the "Mail Recipients" role already has the New-UnifiedGroup cmdlet.

[#3]

Thanks for your answer. Unfortunately this still won't let us achieving our requirement to control by applying it to a security group.

Add-AzureADDirectoryRoleMember : Error occurred while executing AddDirectoryRoleMember
Code: Request_BadRequest
Message: Role membership changes can only contain objects of the following types: 'ServicePrincipal,User'.

So we'll have to create an Application (service principal) and delegate the operations to it, or assign the permissions per-user.

[#4]

Those are the Exchange roles, not the Azure AD ones. You will find them under O365 Admin portal -> Exchange -> Permissions.

[#5]

Thanks, that seems to do the trick.

For the record, seems that:

- following permissions are needed for allowing group creation

•      Mail Recipients
•      Mail Recipients Creation

- still with this it isn't possible to assign that to a security group, but just to specific users

Do you know if this last one is maybe just a limitation in the UI? And what are the cmdlets to perform this operation via PowerShell? (if you know) 

[#6]

You can assign groups, but they need to be mail-enabled security groups.