Home » Blog » Microsoft Teams: How to disable Teams Creation

Microsoft Teams: How to disable Teams Creation

How to disable Teams Creation in Microsoft Teams

When enabling the Teams license in Office 365, every member within the organisation can create new Teams. Giving your employees the possibility to create Teams themselves and according to their needs increases acceptance of the newly introduced tool.

Join or create a team in Microsoft Teams.

Nevertheless, it can lead to problems if many employees have high permission levels. Often it is not clearly defined when it is necessary to create a Team and when a channel or even just a chat is sufficient. It can also lead to Teams with the same purpose being created more than once. It can quickly cause uncontrolled growth that confuses your employees with many Teams without any real benefit.

To prevent uncontrolled growth of Teams, it is a best practice to disable the creation of Teams. Of course, there are other dangers involved in completely depriving users of any freedom in this form. Too strict restrictions can demotivate users or make them lose interest. We recommend implementing a controlled version of Teams creation with Teams Manager offering a request and approval process for Teams.

Get control over your Teams with Teams Manager

How to disable teams creation in Microsoft Teams in 3 steps

Since the standard O365 UI does not provide the option to disable Teams creation, a Powershell script has to be used.

Note: The script will disable not just the creation of Teams but also the creation of groups in general, i.e. sites in SharePoint, sites/groups in Planner, groups in Outlook etc.

Step 1: Before you execute the script, you have to create a security group in your Office 365 Admin Centre. Click on ‘Groups’, add a new group and choose the type ‘Security’.

Step 2: Add member to the group that should later still be able to create teams.

Step 3: Execute the following script to disable the creation of Teams:

(Replace ‘Name of your security group’ with your group name)

Connect-AzureAD
Get-AzureADGroup -SearchString "Name of your security group"

$Template = Get-AzureADDirectorySettingTemplate | where {$_.DisplayName -eq 'Group.Unified'}

$Setting = $Template.CreateDirectorySetting()

New-AzureADDirectorySetting -DirectorySetting $Setting

$Setting = Get-AzureADDirectorySetting -Id (Get-AzureADDirectorySetting | where -Property DisplayName -Value "Group.Unified" -EQ).id
$Setting["EnableGroupCreation"] = $False
$Setting["GroupCreationAllowedGroupId"] = (Get-AzureADGroup -SearchString "Name of your security group").objectid

Set-AzureADDirectorySetting -Id (Get-AzureADDirectorySetting | where -Property DisplayName -Value "Group.Unified" -EQ).id -DirectorySetting $Setting
(Get-AzureADDirectorySetting).Values

Note: In order to execute the script, you need the preview module for Powershell ‘AzureADPreview’. If you already have installed the AzureAD module, you need to uninstall it first.

The creation of Teams is now disabled for users.

This AzureAD Security Group will be the only one that can later create teams.

Note that Global Admin members can also create Microsoft Teams.

Prevent uncontrolled growth in Microsoft Teams with Teams Manager

The Teams Manager offers easy solutions for most admin problems in MS Teams. Check out our features or book a quick demo now.

Comments
  • Hi,
    I wanted to disable Team creation based on ADGroup, but I’ts now disabled for all users.

    I tried to run it again with the $Setting[“EnableGroupCreation”] = $True but I still can’t create Teams.

    Can you please advise how can I revert back?

    • Could you please try deleting the line

      $Setting[“GroupCreationAllowedGroupId”] = (Get-AzureADGroup -SearchString “Name of your security group”).objectid

      from the script? Then it should work again!

  • How can we disable only MS Teams creation? As this approach disables O365 group so users cannot create groups for Planner, Yammer, and SP Hub site? Any help would be helpful..

    • Unfortunately, it is not possible at the moment to disable only Teams creation. For now you can only disable groups creation as a whole.
      We will gladly update you if this changes in the future!

    • This permission can only be given to AD groups, so you need to add all admins to an AD group and then reference this group.

  • New-AzureADDirectorySetting : Error occurred while executing NewDirectorySetting
    Code: Request_BadRequest
    Message: Another object with the same value for property templateId already exists.
    InnerError:
    RequestId: 5c73dd32-5e96-4a30-b00b-62f7d7261a9e
    DateTimeStamp: Sun, 16 Aug 2020 13:21:04 GMT
    HttpStatusCode: BadRequest
    HttpStatusDescription: Bad Request
    HttpResponseStatus: Completed
    At line:8 char:1
    + New-AzureADDirectorySetting -DirectorySetting $Setting
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotSpecified: (:) [New-AzureADDirectorySetting], ApiException
    + FullyQualifiedErrorId : Microsoft.Open.MSGraphBeta.Client.ApiException,Microsoft.Open.MSGraphBeta.PowerShell.New
    DirectorySetting

    • This error means that your AzureAD already has such a setting and that you need to update it. Please try using
      Set-AzureADDirectorySetting
      instead of
      New-AzureADDirectorySetting
      in the script.

    • You need to have Azure AD Directory Administrator rights, as that is where you change the settings. The error below means that you do not have the necessary rights.

  • because while running this script I am getting below error.

    New-AzureADDirectorySetting : Error occurred while executing NewDirectorySetting
    Code: Authorization_RequestDenied
    Message: Insufficient privileges to complete the operation.
    InnerError:
    RequestId: 7b792b59-1566-45b8-9201-78c3ae133817
    DateTimeStamp: Mon, 14 Sep 2020 15:04:21 GMT
    HttpStatusCode: Forbidden
    HttpStatusDescription: Forbidden
    HttpResponseStatus: Completed
    At line:1 char:1
    + New-AzureADDirectorySetting -DirectorySetting $Setting
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotSpecified: (:) [New-AzureADDirectorySetting], ApiException
    + FullyQualifiedErrorId : Microsoft.Open.MSGraphBeta.Client.ApiException,Microsoft.Open.MSGraphBeta.PowerShell.NewDirectorySetting

  • you should mention that running this scripts will prevent users who are not member of the security group the creation of sites in sharepoint, plans in planner, etc,,,

    • You are right, thank you for pointing this out! I have adapted the blog post to clarify that the script will disable not just the creation of Teams but also the creation of groups in general, i.e. sites in SharePoint, sites/groups in Planner, groups in Outlook etc.
      (Users will still be able to create new plans in Planner, as that is separate from group creation.)

Leave a Reply

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.