🎯 Purpose
✅ Restrict who can create Microsoft 365 Groups and Teams to members of a dedicated security group and administrators.
➡️ Prevents uncontrolled group and Team sprawl, and the unmanaged sharing and data storage that comes with it.
👥 Who is affected
✅ Users: All users in the tenant
✅ Allowed to create groups: Members of IBP - SG - Microsoft 365 Group Creators, plus administrators with group management roles
☁️ What is protected
✅ Creation of Microsoft 365 Groups from Outlook, Teams, SharePoint, Planner and other apps
✅ Type: Entra ID tenant directory setting (Group.Unified) and a security group
🔐 How group creation is restricted
Setting | Value |
Security group IBP - SG - Microsoft 365 Group Creators | Created with no members |
Group.Unified › EnableGroupCreation | false (was true) |
Group.Unified › GroupCreationAllowedGroupId | IBP - SG - Microsoft 365 Group Creators |
➡️ Other Group.Unified values are left unchanged.
ℹ️ After deployment: Add the users who should be able to create Microsoft 365 Groups and Teams to IBP - SG - Microsoft 365 Group Creators. Until then, only administrators can create them.
⚙️ What this policy does NOT enforce
🚫 Group naming policy or expiry
🚫 Guest access to groups
🚫 Security group or distribution list creation
🟢 Policy status
✅ Enabled
✅ Applies tenant‑wide
📘 Essential Eight Alignment
✅ Supports governance of collaboration spaces and data storage
ℹ️ Inforcer Best Practice control applied at all maturity levels; not an Essential Eight control
📘 Practical Interpretation (Executive‑Friendly)
This setting ensures that:
✅ New Teams and Microsoft 365 Groups are created by approved people only
✅ The organisation keeps control of where data is stored and shared