Step By Steps instruction how to disable creation of Office 365 Groups.

Microsoft added the ability within Azure AD PowerShell to control who can create Office 365 Groups.

We are going to accomplish this with the following two steps:

• Disable the default ability for everyone to create a new Office 365 Group
• Create Azure AD group with a list of people who are allowed to create groups

We will need to uninstall existing AzureAD or AzureADPreview module and install a new one using the following Powershell commands

Get-InstalledModule -Name "AzureAD*"
Uninstall-Module AzureAD
Uninstall-Module AzureADPreview
Install-Module AzureADPreview

Let check version what we have now.

Get-Module -Name AzureADPreview

Login to https://portal.office.com/adminportal/ and create an Azure Security AD group.
Only members of this group ill are able to create Office 365 Groups.
Only one security group can be used to control who is able to create Office 365 Groups.

 

Run the following commands to connect to Azure

Import-Module AzureADPreview

Connect-AzureAD

Check if there is existing Azure AD Directory Setting

(Get-AzureADDirectorySetting).Values

If there is none, execute the following commands to create new Azure AD Settings

$Template = Get-AzureADDirectorySettingTemplate | where {$_.DisplayName -eq 'Group.Unified'}
$Setting = $Template.CreateDirectorySetting()
New-AzureADDirectorySetting -DirectorySetting $Setting

Run the following command to see what default values are for Azure AD Directory Setting

 (Get-AzureADDirectorySetting).Values

Note default settings for the following commands

GroupCreationAllowedGroupId = BLANK
EnableGroupCreation   = FALSE

 

 

Run the following commands to change EnableGroupCreation and GroupCreationAllowedGroupId.

$Setting = Get-AzureADDirectorySetting -Id (Get-AzureADDirectorySetting | where -Property DisplayName -Value "Group.Unified" -EQ).id
$Setting["EnableGroupCreation"] = $False
$Setting["GroupCreationAllowedGroupId"] = (Get-AzureADGroup -SearchString "Office 365 Groups - Create").objectid
Set-AzureADDirectorySetting -Id (Get-AzureADDirectorySetting | where -Property DisplayName -Value "Group.Unified" -EQ).id -DirectorySetting $Setting

 

Check New Values of Azure AD Directory Setting

(Get-AzureADDirectorySetting).Values

 

Compare ObjectID with GroupCreationAllowedGroupId you created at the beginning of the article.

They must match

Get-AzureADGroup -SearchString "Office 365 Groups - Create" (Get-AzureADDirectorySetting).Values

At this moment, we disabled creation of Office 365 for all end users.

Let login with our user.

Note that  + sign is missing

If he tries to create a group through New Command, he will get the following error message.

 

Let now add out user to Group

Now he can create Ofice 365 Groups

 

And the + sign is back

 

How to revert setting of the original setting?

Microsoft instructions to revert to the original configuration it to run the following line

$SettingId = Get-AzureADDirectorySetting -All $True | where-object {$_.DisplayName -eq "Group.Unified"}
Remove-AzureADDirectorySetting -Id $SettingId.Id

I run this on my tenant. I was able to delete configuration but all client settings were unchanged.

None of the users were able to create Office 365 event if we deleted the whole configuration.
So I came with a proper setting to revert to the original configuration

Run the following PowerShell  lines to revert configuration for EnableGroupCreation  and GroupCreationAllowedGroupId

$Setting = Get-AzureADDirectorySetting -Id (Get-AzureADDirectorySetting | where -Property DisplayName -Value "Group.Unified" -EQ).id
$Setting[""] = $True
$Setting["GroupCreationAllowedGroupId"] = $null
Set-AzureADDirectorySetting -Id (Get-AzureADDirectorySetting | where -Property DisplayName -Value "Group.Unified" -EQ).id -DirectorySetting $Setting

Now you can use original Microsoft command to delete configuration

$SettingId = Get-AzureADDirectorySetting -All $True | where-object {$_.DisplayName -eq “Group.Unified”} Remove-AzureADDirectorySetting -Id $SettingId.Id

 

After running this command all configuration is reverted and all users can create Office 365 groups as was before.