This is the third post in my Office 365 Groups for Admins series and it will focus on one of the primary tasks an Office 365 Admin has to do once their tenant is up and running; should we allow our users to create Office 365 Groups or not? I’m not going to give you an answer to this. It is something you need to evaluate properly within your organization, but I do recommend that you initially always turn off Groups, so that you can get some governance into the game before promoting it to everyone.

Important! Disabling Office 365 Group creation as described in this post will only disable it in the user interface (for everyone, including admins). We can still create Unified Groups using PowerShell (more on that in later posts).

I will show you how to check the status of Groups creation, how to disable it and how to enable it (you will eventually do this…cause the Unified Groups rocks!). To do all this we need to use PowerShell, there is no way to do this in the UI or admin portal of Office 365.

Check the Office 365 Groups creation status

To check if our users are allowed to create Groups we start a (new) PowerShell session and executes the following statements:

# Connect to EXO
$creds = Get-Credential

$Session = New-PSSession -ConfigurationName Microsoft.Exchange `
    -ConnectionUri https://outlook.office365.com/powershell-liveid/  `
    -Credential $creds -Authentication Basic -AllowRedirection 

Import-PSSession $Session

# Check status
Get-OwaMailboxPolicy | select GroupCreationEnabled

Remove-PSSession $Session

All the Unified Groups PowerShell scripts exits in Exchange Online. In order to connect our PowerShell session to Exchange Online, we need an Exchange/Global Online admin credential. Using that credential we create a new PowerShell session and connect that session to the cloud. Once we have the session we can import it and start working with the Exchange Online cmdlets.

The cmdlet we want to use is the Get-OwaMailboxPolicy and the property we want to take a look at is GroupeCreationEnabled. If it is set to true, then end users can create Groups and vice versa.

GroupCreationEnabled

Disable creation of Office 365 Groups

Disable creation is quite simple, we need to do the same connection thing as we did above and then use the Set-OwaMailBoxPolicy cmdlet to prohibit creation, like this:

# Connect to EXO
$creds = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange  `
    -ConnectionUri https://outlook.office365.com/powershell-liveid/ `
    -Credential $creds -Authentication Basic -AllowRedirection
Import-PSSession $Session

# Disable
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -GroupCreationEnabled $false

Remove-PSSession $Session

As you can see we only need to set the GroupCreationEnabled switch to $false and we’re all set.

No creation of Groups hereFrom now on end users will be unable to create new Groups in the user interface. If the click the create new group function in the web interface they will get an error saying that you’re not allowed to create a Group. In Outlook 2016 (after restarting Outlook) it is even better, the Create Group function is actually disabled.

Enable creation of Office 365 Groups

Turning Office 365 Groups creation back on is just as easy as turning it off.

# Connect to EXO
$creds = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange  `
    -ConnectionUri https://outlook.office365.com/powershell-liveid/ `
    -Credential $creds -Authentication Basic -AllowRedirection
Import-PSSession $Session

# Enable
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -GroupCreationEnabled $true

Remove-PSSession $Session

Summary

As you’ve seen in this post it is very easy to enable or disable Groups creation. In this series we’ll come back to even more PowerShell administration.