Turn off ability to create teams

[Ayaz Younis]

Hi all,

From a safeguarding and child protection point of view, in a school environment, it is not appropriate to allow students or staff to create new teams. Can the ability to disable team creation please be added?

Unfortunately the powershell options to disable teams/O365 groups requires you to have Azure AD Premium, which many peopl including ourselves do not have. The UI option in Azure AD to stop users creating security/O365 groups, even when set to No, does not work.

Students are still able to create Teams, and the fear is that this could be used for bullying purposes. Our senior child protection officer will not allow Teams to be sued until the ability to stop users from creating Teams is turned off. Only admins should be able to create Teams/O365 groups.

Feel free to add weight to uservoice - https://microsoftteams.uservoice.com/forums/555103-public/suggestions/35505892-disable-team-creation

Thanks.

[#2 · Accepted solution]

We also have had a A1 plan with Azure Basic which should be included. It is difficult to setup the process but it should be supported to disable this feature.

Disable Teams: http://macslui.blogspot.com/2017/11/disable-self-service-teams-creation.html

Manage 365 Groups: https://support.office.com/en-us/article/Manage-who-can-create-Office-365-Groups-4c46c8cb-17d0-44b5-...

In addition persons can create Distribution List if that feature is available to users if you have not secure it.

http://msweany.blogspot.com/2014/06/office365-remove-users-create-dist-list.html

[#3]

Adding group creation restriction does require Azure AD Premium for anyone included in the group you assign to be able to create groups / teams 

https://blogs.technet.microsoft.com/undocumentedfeatures/2017/04/29/disable-office-365-groups-creati...

[#4]

We do not recommend to disable people from creating Teams as it takes away a lot of the value that Teams provide. Instead we would recommend to double down of user education -- and make users aware that the admin can see who created certain Team in case their is an inappropriate Team being created.

More information: https://docs.microsoft.com/en-us/microsoftteams/plan-teams-governance-edu

[#5]

Thanks for the comments guys, really appreciate it.

Thomas, whilst I agree in principle, educating the kids to behave is the way forward. But our concern is not really kids messing about and creating random groups, its teams that are created for the purpose of bullying. We take a zero tolerance approach on bullying and abuse and it would be seen as very bad if we were the ones facilitating this abuse. Also, it becomes very time intensive trawling through many groups, trying to ascertain which is genuine and which isnt.

[#6]

Scott and Christopher thanks for your help.

Im just wondering which is the better option or what the difference is between them?

We have an on premises Exchange, we use 365 for SharePoint, Teams, etc. only.

[#7]

Thanks Scott. I tried it and it worked. Many thanks.

[#8]

From what I understand you can easily create the group creation restriction policy without being assigned the appropriate Azure AD Premium licences, but that doesn't necessarily mean it's not a requirement to be compliant?

"Doing the steps in this article requires a subscription to Azure Active Directory (Azure AD) Premium. The administrator who configures the settings, and the members of the affected groups, must have Azure AD Premium licenses assigned to them"

https://support.office.com/en-us/article/manage-who-can-create-office-365-groups-4c46c8cb-17d0-44b5-...

[#9]

Hi, I can briefly share, how we do it (we have an organization where after final migration approx. 155.000 users are active, so we govern Teams). We have created a group in Azure. This group was given the right to create groups. The creation itself however is done via our SW Portal, people fill out a short request form, we approve or decline and then a team in the backgroud utilizes Graph API for the creation, however Teams Part on top of Group still is done manually (until the API is GA, so soon this manual part will vanish).

[#10]

Yeah, I just learned about that this week. Just the admins that can create Teams that are in this "restricted group" need a license to be compliant.

[#11]

@Thomas Binder The problem is, you mention "people" in general. I agree with this, but consider students and especially pupils - there should be an easy button for school admins, avoiding PowerShell completely.

[#12]

@Thomas BinderI think you missing the point if i'm honest from a Educational perspective.  

[#13]

@Thomas Binder seriously!

Ever heard of an IT department trying to manage a SharePoint site and keeping it organised and tidy. We have people creating teams constantly - even after education. The teams sites are never setup correctly, they are never attached to the hub site (they cant do that unless they are an admin anyway), never added to the sharepoint Teams links page on our intranet. 

Further as a growing business it requires constant education of new staff to want to use it because they see it available. One person created a team site for his personal files!! 

Why is it so hard to give the OPTION for the site administrators to control who can create teams. IF they want to allow freedom - great let them have it, but most corporate business want to control how their Intranet and sharepoint sites are structured.

[#14]

@Thomas Binder take off those rose colored glasses yet? 

[#15]

@Donnie Ewers   anyone who thinks educating users instead of limiting access this has know clue how to manage a IT department.

organizing and having a structure that is clean for SharePoint is extremely important and this is a huge deal regardless of educating users or not. 

its the equivalent to allowing anyone make distribution groups and when you grow in size, you have hundreds of useless teams groups made for 1,2,3 users that end up being used for a few weeks, days, or not touched for years

then you have to clean up a mess of stuff. this recommendation of just "educating" users is beyond stupid.

[#16]

@Thomas Binder 

Classic case of "software provider thinks they know best" 🥴

Education is great, sometimes it doesn't work and user privileges are a better safeguard. We don't have time to be constantly educating people on what is not best practice and fixing up the issues caused by software that has dumb flaws in design.

Imagine saying "oh no, there's no need to have private folders.. just educate people not to go into the folders they shouldn't". Absolutely ludicrous.

It's "in case there is" by the way, not their.