By default, users in your organization can create new team in Microsoft Teams. This can lead to unmanaged group creation and, at times, the creation of duplicate teams, which can cause confusion and security risks for your Microsoft 365 organization.
As an admin you can restrict users from creating team in Microsoft Teams with following options.
There is no direct method to restrict users from creating teams, but you can restrict Microsoft 365 group creation, which will prevent users from creating teams in Microsoft Teams.
- Log in to the Microsoft Entra admin center.
- Navigate to Entra ID»Groups»General.
- Locate the option Microsoft 365 Groups.
- To prevent users from creating teams, select No and click Save.
When you enable this setting, it prevents users from creating Teams and stops them from creating Microsoft 365 groups in SharePoint, Outlook, and Planner.
Only admins will be able to create Teams or Microsoft 365 groups, and they can only do so from the admin centers. Administrators will not be able to create groups directly from collaborative spaces like Microsoft Teams, SharePoint, Outlook, or Planner.
Sometimes, organizations may need to allow group creation through workspaces for specific users. For example, certain users can be permitted to create groups in collaborative spaces like Teams, SharePoint, or Planner while restricting others to avoid the unnecessary group creation.
To do this, you need to create a group of users who are allowed to create Microsoft 365 groups or teams.
- Log in to the Entra admin center and go to the Groups tab.
- Choose All groups and then click on "New group".
- Select the appropriate Group type (preferably Security) and enter the desired group name.
- Click No members selected link under Members section.
- In the Users tab, select who can create teams, then click ‘Select’ and hit Create.
Once you've created the group with users who are allowed to create teams or groups, you need to run the following PowerShell script using your global admin account.
Import-Module Microsoft.Graph.Beta.Identity.DirectoryManagement
Import-Module Microsoft.Graph.Beta.Groups
Connect-MgGraph -Scopes "Directory.ReadWrite.All", "Group.Read.All"
$GroupName = "GroupName"
#Replace this with the name of the group that contains users who are allowed to create teams or M365 groups.
$AllowGroupCreation = "False"
$settingsObjectID = (Get-MgBetaDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
if(!$settingsObjectID){
$params = @{
templateId = "62375ab9-6b52-47ed-826b-58e47e0e304b"
values = @(
@{
name = "EnableMSStandardBlockedWords"
value = "true"
}
)
}
New-MgBetaDirectorySetting -BodyParameter $params
$settingsObjectID = (Get-MgBetaDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
}
$groupId = (Get-MgBetaGroup | Where-object {$_.displayname -eq $GroupName}).Id
$params = @{
templateId = "62375ab9-6b52-47ed-826b-58e47e0e304b"
values = @(
@{
name = "EnableGroupCreation"
value = $AllowGroupCreation
}
@{
name = "GroupCreationAllowedGroupId"
value = $groupId
}
)
}
Update-MgBetaDirectorySetting -DirectorySettingId $settingsObjectID -BodyParameter $params
(Get-MgBetaDirectorySetting -DirectorySettingId $settingsObjectID).Values
Replace
<GroupName> with the name of the group that contains users who are allowed to create teams or M365 groups.
To verify the execution of the script, check the value of the GroupCreationAllowedGroupId, which shows the group ID of users allowed to create groups. Additionally, if the EnableGroupCreation is set to False, it means only the selected group members can create Microsoft 365 groups or teams.
Windows PowerShell 
