Microsoft Teams — Governance
How to restrict who can create Teams in your tenant
Teams creation is controlled by Microsoft 365 Group creation under the hood. Restrict who can create M365 Groups and Teams creation follows automatically. The script below applies that restriction tenant-wide and optionally allows a specific security group to bypass it.
The PowerShell script
Run the whole script, not just the bottom half. The
if block at the start checks whether the Group.Unified directory setting exists in your tenant and creates it if not. If the setting is missing and you skip that block, the Update-MgBetaDirectorySetting call at the end will fail with no useful error message.
Import-Module Microsoft.Graph.Beta.Identity.DirectoryManagement
Import-Module Microsoft.Graph.Beta.Groups
Connect-MgGraph -Scopes "Directory.ReadWrite.All", "Group.Read.All"
# Leave GroupName empty to block all users except Global Admins
$GroupName = ""
$AllowGroupCreation = "False"
$settingsObjectID = (Get-MgBetaDirectorySetting |
Where-Object -Property Displayname -Value "Group.Unified" -EQ).id
if (!$settingsObjectID) {
$params = @{
templateId = "62375ab9-6b52-47ed-826b-58e47e0e304b"
values = @(
@{
name = "EnableMSStandardBlockedWords"
value = $true
}
)
}
New-MgBetaDirectorySetting -BodyParameter $params
$settingsObjectID = (Get-MgBetaDirectorySetting |
Where-Object -Property Displayname -Value "Group.Unified" -EQ).Id
}
$groupId = (Get-MgBetaGroup -All |
Where-Object { $_.displayname -eq $GroupName }).Id
$params = @{
templateId = "62375ab9-6b52-47ed-826b-58e47e0e304b"
values = @(
@{
name = "EnableGroupCreation"
value = $AllowGroupCreation
}
@{
name = "GroupCreationAllowedGroupId"
value = $groupId
}
)
}
Update-MgBetaDirectorySetting -DirectorySettingId $settingsObjectID -BodyParameter $params
# Confirm the applied values
(Get-MgBetaDirectorySetting -DirectorySettingId $settingsObjectID).Values
Before you run this
-
Set your allowed group name If you want a specific security group to retain the ability to create Teams and Groups, put its exact display name in
$GroupName. Leave it empty to block all users across the tenant (Global Admins are always exempt regardless). -
Expect propagation delay Changes to directory settings can take a few hours to reach all users across the tenant. Do not assume the setting failed if it does not take effect within minutes.
-
Do not test with a Global Admin account Global Admins can always create Groups and Teams regardless of this setting. If you test with your admin account and Teams creation still works, that is expected behaviour, not a sign the script failed. Test with a standard user account.
-
Channel creation is a separate control This script controls who can create new Teams and Groups. The ability to create channels within an existing Team is a different setting, managed under Teams meeting policies in the Teams admin center.
This setting affects more than Teams. Restricting M365 Group creation also prevents those users from creating Planner plans, SharePoint team sites via the SharePoint start page, Yammer communities, and any other workload that provisions an M365 Group under the hood. Make sure the security group you put in
$GroupName covers everyone who legitimately needs to create any of these resources, not just Teams.
Microsoft reference: learn.microsoft.com — Manage who can create Microsoft 365 Groups
Need help rolling this out across your tenant?
We can review your current Group and Teams governance settings, identify gaps, and put together a policy that fits how your organisation actually works.
Book a session with MStack360