Restrict "Create Site" permissions to "Restricted Read" users

[Ashish Jain]

I have give all users of my tenant "Restricted Read" permissions on the root site collection so that they cannot create site collections and sub-sites in the tenant. When any such user logs into the sharepoint site, s/he cannot see the SharePoint link in the top bar that navigates to SharePoint page.

However when the user types in the browser window the direct URL:

https://mytenant.sharepoint.com/_layouts/15/SharePoint.aspx

s/he can navigate to the page and can see the "Create Site" link at the top. Although s/he cannot create a site, but can still see the option. Am I missing adding/removing any specific permission or this is an expected bahvior?

[#2]

You need to disable self-service site creation in SharePoint Online configuration

[#3]

I can do it. But I want specific userrs to have access to the same. Lets say, I have a security group which should have access to create site collections for users. 

[#4]

An option is to use a SharePoint List, Flow and Azure Function. Configure SharePoint settings as suggested and then create a list that only allowed users can add to, create a Flow for when an item is added. Create an Azure Function to create a SharePoint site or O365 group. Get Flow to call the Azure Function. As a last step, you might want to email the user.
You can also change the Create Site link to go to a custom page to create a list item but need to have some messaging for users who can't create items.
There is a blog on this but I can't find the link.

[#5]

Agreeed. However that's an alternate solution. What I am talking about is the default behavior. When restricted read permission level does not have "Use Self-Service Site Creation" permissions, that how is the user still able to view the "Create Site" option.