What this check looks at
Checks that ordinary users cannot create Microsoft 365 groups, each with a SharePoint site, a group mailbox and, if it becomes a team, a team.
A Microsoft 365 group is more than a membership list: creating one also creates a SharePoint site, a shared mailbox and calendar, a Planner plan and, if it becomes a team, a Microsoft Teams team. By default every user can create one, from Outlook, Teams, SharePoint or the Azure portal, API and PowerShell.
The check reads the Group.Unified directory setting and passes when EnableGroupCreation is off, whether or not creation is left to the members of one chosen group. It fails when every user can create groups, including when no Group.Unified setting has been saved, because Entra’s default allows it. It reports not checked when the setting holds a value that is not true or false.
Open creation is how tenants end up with hundreds of teams and sites called "Test", "Project" or someone’s name, each holding files, with owners who have left. Nobody reviews their sharing, retention or membership, and finding data in them for a subject access request or a legal hold becomes slow.
Why it matters
Every Microsoft 365 group brings a SharePoint site, a mailbox and often a team. Left open, people create them freely, and the organisation ends up with sites full of data that no one owns or reviews.
In a tenant that has never restricted creation, groups accumulate with every project, trial and experiment, and their owners move on or leave. When a client asks where their data is held, or a departing employee’s files must be found, every one of those sites has to be searched, including the ones nobody remembers creating.
Restricting creation does not stop people working together: it routes new teams through a request, so each has a named owner, a sensible name and the right sensitivity label. Many organisations leave creation to a small group such as IT or team leads.
CIS Microsoft 365 Foundations Benchmark v7.0.0 5.1.3.4 (Level 2) asks for users not to be able to create Microsoft 365 groups in Azure portals, API or PowerShell, and maps it to CIS Controls v8 6.8 (role-based access control). ISO 27001 A.5.9 (inventory of information and other associated assets) and NCSC CAF A3.a cover knowing what data is held and where.
How to fix it
Where: Entra admin centre → Entra ID → Groups → General
Before you start
- Agree who creates groups and teams on request, and how people ask. Check whether the members of a chosen creation group need Microsoft Entra ID P1 (Microsoft’s pages differ).
Step by step
- Agree how people will ask for a group. Before turning creation off, agree with the tenant who will create groups and teams on request, and how people ask (a form, a ticket or a named person). Turning it off without that leads to shadow alternatives.
- Choose who may still create groups. If some people should keep creating groups, make a security group for them, for example "Group creators". Microsoft’s pages differ on whether leaving creation to a group needs Microsoft Entra ID P1 for its members, so check the tenant’s licences first; administrators can always create groups.
- Turn off creation for everyone else. In the Microsoft Entra admin centre, go to Entra ID > Groups > General and set "Users can create Microsoft 365 groups in Azure portals, API or PowerShell" to No. To leave creation to the security group, use Microsoft’s script from "Manage who can create Microsoft 365 groups", which sets EnableGroupCreation to False and GroupCreationAllowedGroupId to the group’s ID in the Group.Unified setting.
- Tell people. Let staff know that new teams and groups are now requested, and how. Existing groups and teams are not affected.
- Confirm the setting. In Microsoft Graph PowerShell, run (Get-MgBetaDirectorySetting | Where-Object DisplayName -eq "Group.Unified").Values and check EnableGroupCreation is False. The next assessment passes.
What users will notice
People outside the chosen group can no longer create Microsoft 365 groups or teams from Outlook, Teams or SharePoint; existing groups are not affected.
How to confirm it worked
The Group.Unified directory setting shows EnableGroupCreation False (Entra admin centre → Entra ID → Groups → General shows No).
Frameworks and controls
This check maps to controls in 11 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A3.a Asset management |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Data |
| SOC 2 | CC6.3 Role-based access and least privilege |
| NIST SP 800-171 | 3.1.5 Employ the principle of least privilege |
| CMMC Level 2 | AC.L2-3.1.5 Least Privilege |
| ISO 27001:2022 | A.5.9 Inventory of information and other associated assetsA.5.15 Access control |
| CIS M365 | 5.1.3.4 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No' |
| CIS Controls v8.1 | 6.8 Define and maintain role-based access control (IG3) |
| NIST CSF 2.0 | ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained |
| NCSC 10 Steps | Asset management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage who can create Microsoft 365 groups (Microsoft Learn)