By default, anyone in your organization can create a team. That’s fine for the first dozen. It stops being fine when you have four hundred teams, three of them called “Marketing,” half abandoned, and nobody sure which one holds the file they need. Open self-service creation is convenient right up until it becomes a governance problem you have to clean up by hand.
The control you’re looking for isn’t in the Teams admin center, which surprises people. Creating a team creates a Microsoft 365 group behind it, so the lever is at the group level in Microsoft Entra. Restrict who can create groups and you’ve restricted who can create teams. This guide covers exactly how to do that with PowerShell, who keeps the ability afterward, the side effects on other apps, and the naming and expiration policies that keep the whole thing tidy.
How the restriction actually works
Microsoft 365 group creation has a tenant setting with two parts that work together:
EnableGroupCreation— when set tofalse, ordinary users can no longer create Microsoft 365 groups (and therefore teams).GroupCreationAllowedGroupId— the object ID of a security group whose members are allowed to create groups, even while everyone else is blocked.
So the pattern is: turn off creation for everyone, then nominate one security group as the exception. Put the people who legitimately need to spin up teams — IT, team leads, project managers, whoever fits your governance model — into that security group. Everyone else has to request a team through whatever process you set up.
Administrators with the right roles bypass this entirely, which is by design. The policy is aimed at end users, not admins.
Step 1: create a security group for the allowed creators
First, make a security group in Entra (or reuse one) and add the people who should keep the ability to create teams. Note its object ID — you’ll need it in the next step.
# Connect with the Microsoft Graph PowerShell SDK
Connect-MgGraph -Scopes "Group.ReadWrite.All", "Directory.ReadWrite.All"
# Create the security group
$group = New-MgGroup -DisplayName "Team Creators" `
-MailEnabled:$false -MailNickname "teamcreators" `
-SecurityEnabled:$true
$group.Id # note this object ID for the next stepAdd the right people to that group before you flip the restriction on, so there’s no window where nobody outside of admins can create anything.
Before you restrict team creation
- A security group exists with everyone who should keep creation rights
- You've noted that group's object ID
- You've accounted for non-Teams apps (Planner, SharePoint, Outlook groups)
- There's a request process for users who now can't self-create
- You've confirmed Entra ID P1 licensing if you also want naming/expiration policies
Step 2: restrict group creation to that security group
Now configure the directory’s group settings. Microsoft 365 group creation is controlled by a settings object based on the Group.Unified template. If your tenant doesn’t have that settings object yet, you create it; if it exists, you update it.
$allowedGroupId = "<object-id-of-Team-Creators>"
# Get the Group.Unified directory setting template
$template = Get-MgDirectorySettingTemplate |
Where-Object { $_.DisplayName -eq "Group.Unified" }
# Build values: turn off open creation, allow the security group
$params = @{
TemplateId = $template.Id
Values = @(
@{ Name = "EnableGroupCreation"; Value = "false" }
@{ Name = "GroupCreationAllowedGroupId"; Value = $allowedGroupId }
)
}
New-MgDirectorySetting -BodyParameter $paramsIf a directory setting already exists, retrieve it with Get-MgDirectorySetting, update the two values, and save it back with Update-MgDirectorySetting rather than creating a duplicate.
Who can still create teams afterward
After the restriction is live, the ability to create a team is limited to:
- Members of the allowed security group (
GroupCreationAllowedGroupId). - Administrators with roles that bypass the restriction — Global Administrator, Teams Administrator, User Administrator, and Groups Administrator among them.
Everyone else gets blocked when they try to create a team, and the Create team path either disappears or returns a permissions message. That’s expected. The usual model is a short request form or ticket: a user asks, an approver creates the team (or adds them temporarily to the creators group), and the team gets made with proper naming from the start.
Who can create teams after the restriction
| Members of the allowed security group | Yes — that's the exception you defined |
|---|---|
| Global / Teams / User / Groups admins | Yes — admin roles bypass the restriction |
| Regular end users | No — they request a team instead |
| Guests | No — guests can't create teams regardless |
Step 3: add a naming policy
Restricting who creates teams solves half the sprawl problem. A naming policy handles the other half — what they’re called — so teams sort and search sensibly instead of turning into a pile of “Project,” “Project 2,” and “Test.”
A Microsoft 365 group naming policy can:
- Add a prefix or suffix (fixed text like
GRP-, or an attribute like the department or a region code). - Block specific words so users can’t create teams named with reserved or inappropriate terms.
$settings = Get-MgDirectorySetting |
Where-Object { $_.DisplayName -eq "Group.Unified" }
($settings.Values | Where-Object { $_.Name -eq "PrefixSuffixNamingRequirement" }).Value = "GRP-[Department]-[GroupName]"
($settings.Values | Where-Object { $_.Name -eq "CustomBlockedWordsList" }).Value = "CEO,Payroll,HR"
Update-MgDirectorySetting -DirectorySettingId $settings.Id -BodyParameter @{ Values = $settings.Values }Step 4: add an expiration policy
The last piece of governance deals with teams nobody uses anymore. A group expiration policy sets a lifetime — say 180 or 365 days — after which an inactive group is flagged for renewal. Owners get a notification and have to renew, or the group (and its team) is deleted after a grace period. Groups with activity renew automatically.
This is what keeps abandoned teams from accumulating forever. You set the lifetime, choose whether it applies to all groups or a selected set, and name a fallback owner for ownerless groups.
New-MgGroupLifecyclePolicy -GroupLifetimeInDays 180 `
-ManagedGroupTypes "All" `
-AlternateNotificationEmails "[email protected]"Licensing note
The group creation restriction itself works with standard Microsoft Entra. The naming policy and the group expiration policy, however, require Microsoft Entra ID P1 (or higher) for the members involved. Confirm your licensing before you build governance around those two features — restricting creation is free to set up, but the polish on top isn’t.
What each control needs
| Restrict group/team creation | Works with Microsoft Entra; no premium tier required |
|---|---|
| Naming policy (prefix/suffix, blocked words) | Microsoft Entra ID P1 or higher |
| Group expiration policy | Microsoft Entra ID P1 or higher |
Wrapping up
You control who can create teams by controlling Microsoft 365 group creation, not through a Teams toggle. Turn off open creation with EnableGroupCreation, nominate a security group in GroupCreationAllowedGroupId, and remember the change ripples across Planner, SharePoint, and every other group-backed app — so size the allowed group accordingly. Layer a naming policy on top for consistency and an expiration policy to retire dead teams, keeping in mind both need Entra ID P1.
Once governance is in place, the day-to-day work is structuring the teams people do create — see how to create a team in Microsoft Teams, how to carve out spaces with private channels, and how outsiders fit in through guest access.
