Microsoft Entra cmdlets for configuring group settings

Article
12/12/2024

This article contains instructions for using PowerShell cmdlets to create and update groups in Microsoft Entra ID, part of Microsoft Entra. This content applies only to Microsoft 365 groups.

Important

Some settings require a Microsoft Entra ID P1 license. For more information, see the Template settings table.

For more information on how to prevent nonadministrator users from creating security groups, set the AllowedToCreateSecurityGroups property to False as described in Update-MgPolicyAuthorizationPolicy.

Microsoft 365 groups settings are configured using a Settings object and a SettingsTemplate object. Initially, you don't see any Settings objects in your directory, because your directory is configured with the default settings. To change the default settings, you must create a new settings object using a settings template. Microsoft provides several settings templates. To configure Microsoft 365 group settings for your directory, you use the template named "Group.Unified". To configure Microsoft 365 group settings on a single group, use the template named "Group.Unified.Guest This template is used to manage guest access to a Microsoft 365 group.

The cmdlets are part of the Microsoft Graph PowerShell module. For instructions how to download and install the module on your computer, see Install the Microsoft Graph PowerShell SDK.

Note

Even with the restrictions enabled to prevent the addition of guests to Microsoft 365 groups, administrators can still add guest users. The restriction only applies to non-admin users.

Install PowerShell cmdlets

Install the Microsoft Graph cmdlets as described in Install the Microsoft Graph PowerShell SDK.

Open the Windows PowerShell app as an administrator.

Install the Microsoft Graph cmdlets.

Install-Module Microsoft.Graph -Scope AllUsers

Install the Microsoft Graph beta cmdlets.

Install-Module Microsoft.Graph.Beta -Scope AllUsers

Create settings at the directory level

These steps create settings at directory level, which apply to all Microsoft 365 groups in the directory.

In the DirectorySettings cmdlets, you must specify the ID of the SettingsTemplate you want to use. If you don't know this ID, this cmdlet returns the list of all settings templates:

Get-MgBetaDirectorySettingTemplate

This cmdlet call returns all templates that are available:

Id                                   DisplayName         Description
--                                   -----------         -----------
62375ab9-6b52-47ed-826b-58e47e0e304b Group.Unified       ...
08d542b9-071f-4e16-94b0-74abb372e3d9 Group.Unified.Guest Settings for a specific Microsoft 365 group
16933506-8a8d-4f0d-ad58-e1db05a5b929 Company.BuiltIn     Setting templates define the different settings that can be used for the associ...
4bc7f740-180e-4586-adb6-38b2e9024e6b Application...
898f1161-d651-43d1-805c-3b0b388a9fc2 Custom Policy       Settings ...
5cf42378-d67d-4f36-ba46-e8b86229381d Password Rule       Settings ...

To add a usage guideline URL, first you need to get the SettingsTemplate object that defines the usage guideline URL value; that is, the Group. Unified template:

$TemplateId = (Get-MgBetaDirectorySettingTemplate | where { $_.DisplayName -eq "Group.Unified" }).Id
$Template = Get-MgBetaDirectorySettingTemplate | where -Property Id -Value $TemplateId -EQ

Create an object that contains values to be used for the directory setting. These values change the usage guideline value and enable sensitivity labels. Set these or any other setting in the template as required:

$params = @{
   templateId = "$TemplateId"
   values = @(
      @{
         name = "UsageGuidelinesUrl"
         value = "https://guideline.example.com"
      }
      @{
         name = "EnableMIPLabels"
         value = "True"
      }
   )
}

Create the directory setting by using the New-MgBetaDirectorySetting:
```
New-MgBetaDirectorySetting -BodyParameter $params
```

You can read the values by using the following commands:

$Setting = Get-MgBetaDirectorySetting | where { $_.DisplayName -eq "Group.Unified"}
$Setting.Values

Update settings at the directory level

To update the value for UsageGuideLinesUrl in the setting template, read the current settings from Microsoft Entra ID, otherwise we could end up overwriting existing settings other than the UsageGuideLinesUrl.

Get the current settings from the Group.Unified SettingsTemplate:

$Setting = Get-MgBetaDirectorySetting | where { $_.DisplayName -eq "Group.Unified"}

Check the current settings:

$Setting.Values

This command returns the following values:

Name                            Value
----                            -----
EnableMIPLabels                 True
CustomBlockedWordsList
EnableMSStandardBlockedWords    False
ClassificationDescriptions
DefaultClassification
PrefixSuffixNamingRequirement
AllowGuestsToBeGroupOwner       False
AllowGuestsToAccessGroups       True
GuestUsageGuidelinesUrl
GroupCreationAllowedGroupId
AllowToAddGuests                True
UsageGuidelinesUrl              https://guideline.example.com
ClassificationList
EnableGroupCreation             True
NewUnifiedGroupWritebackDefault True

To remove the value of UsageGuideLinesUrl, edit the URL to be an empty string:

$params = @{
   Values = @(
      @{
         Name = "UsageGuidelinesUrl"
         Value = ""
      }
   )
}

Update the value by using the Update-MgBetaDirectorySetting cmdlet:

Update-MgBetaDirectorySetting -DirectorySettingId $Setting.Id -BodyParameter $params

Template settings

Here are the settings defined in the Group.Unified SettingsTemplate. Unless otherwise indicated, these features require a Microsoft Entra ID P1 license.

Setting	Description
EnableGroupCreation Type: `Boolean` Default: `True`	This flag indicates whether nonadmin users can create Microsoft 365 groups in the directory. This setting doesn't require a Microsoft Entra ID P1 license.
GroupCreationAllowedGroupId Type: `String` Default: `""`	GUID of the security group for which the members are allowed to create Microsoft 365 groups even when `EnableGroupCreation == false`.
UsageGuidelinesUrl Type: `String` Default: `""`	A link to the Group Usage Guidelines.
ClassificationDescriptions Type: `String` Default: `""`	A comma-delimited list of classification descriptions. The value of `ClassificationDescriptions` is only valid in this format: `$setting["ClassificationDescriptions"] ="Classification:Description,Classification:Description"` where Classification matches an entry in the ClassificationList. This setting doesn't apply when `EnableMIPLabels == True`. Character limit for property `ClassificationDescriptions` is 300, and commas can't be escaped.
DefaultClassification Type: `String` Default: `""`	The classification that is to be used as the default classification for a group if none was specified. This setting doesn't apply when `EnableMIPLabels == True`.
PrefixSuffixNamingRequirement Type: `String` Default: `""`	String of a maximum length of 64 characters that defines the naming convention configured for Microsoft 365 groups. For more information, see Enforce a naming policy for Microsoft 365 groups.
CustomBlockedWordsList Type: `String` Default: `""`	Comma-separated string of phrases that users aren't allowed to use in group names or aliases. For more information, see Enforce a naming policy for Microsoft 365 groups.
EnableMSStandardBlockedWords Type: `Boolean` Default: `False`	Deprecated. Don't use.
AllowGuestsToBeGroupOwner Type: `Boolean` Default: `False`	Boolean indicating whether or not a guest user can be an owner of groups.
AllowGuestsToAccessGroups Type: `Boolean` Default: `True`	Boolean indicating whether or not a guest user can have access to Microsoft 365 groups content. This setting doesn't require a Microsoft Entra ID P1 license.
GuestUsageGuidelinesUrl Type: `String` Default: `""`	The URL of a link to the guest usage guidelines.
AllowToAddGuests Type: `Boolean` Default: `True`	A boolean indicating whether or not it is allowed to add guests to this directory. This setting may be overridden and become read-only if `EnableMIPLabels` is set to True and a guest policy is associated with the sensitivity label assigned to the group. If the `AllowToAddGuests` setting is set to False at the organization level, any `AllowToAddGuests` setting at the group level is ignored. If you want to enable guest access for only a few groups, you must set `AllowToAddGuests` to be true at the organization level, and then selectively disable it for specific groups.
ClassificationList Type: `String` Default: `""`	A comma-delimited list of valid classification values that can be applied to Microsoft 365 groups. This setting doesn't apply when EnableMIPLabels == True.
EnableMIPLabels Type: `Boolean` Default: `False`	The flag indicating whether sensitivity labels published in Microsoft Purview compliance portal can be applied to Microsoft 365 groups. For more information, see Assign Sensitivity Labels for Microsoft 365 groups.
NewUnifiedGroupWritebackDefault Type: `Boolean` Default: `True`	The flag that allows an admin to create new Microsoft 365 groups without setting the groupWritebackConfiguration resource type in the request payload. This setting is applicable when group writeback is configured in Microsoft Entra Connect. `NewUnifiedGroupWritebackDefault` is a global Microsoft 365 group setting. Default value is true. Updating the setting value to false changes the default writeback behavior for newly created Microsoft 365 groups, and doesn't change the isEnabled property value for existing Microsoft 365 groups. Group admin needs to explicitly update the group isEnabled property value to change the writeback state for existing Microsoft 365 groups.

Example: Configure Guest policy for groups at the directory level

Get all the setting templates:
```
Get-MgBetaDirectorySettingTemplate
```

To set guest policy for groups at the directory level, you need the Group.Unified template.

$Template = Get-MgBetaDirectorySettingTemplate | where -Property Id -Value "62375ab9-6b52-47ed-826b-58e47e0e304b" -EQ

Set a value for AllowToAddGuests for the specified template:

$params = @{
   templateId = "62375ab9-6b52-47ed-826b-58e47e0e304b"
   values = @(
      @{
         name = "AllowToAddGuests"
         value = "False"
      }
   )
}

Next, create a new settings object by using the New-MgBetaDirectorySetting cmdlet:
```
$Setting = New-MgBetaDirectorySetting -BodyParameter $params
```
You can read the values using:
```
$Setting.Values
```

Read settings at the directory level

If you know the name of the setting you want to retrieve, you can use the below cmdlet to retrieve the current settings value. In this example, we're retrieving the value for a setting named UsageGuidelinesUrl.

(Get-MgBetaDirectorySetting).Values | where -Property Name -Value UsageGuidelinesUrl -EQ

These steps read settings at directory level, which apply to all Office groups in the directory.

Read all existing directory settings:

Get-MgBetaDirectorySetting -All

This cmdlet returns a list of all directory settings:

Id                                   DisplayName   TemplateId                           Values
--                                   -----------   ----------                           ------
c391b57d-5783-4c53-9236-cefb5c6ef323 Group.Unified 62375ab9-6b52-47ed-826b-58e47e0e304b {class SettingValue {...

Read all settings for a specific group:

Get-MgBetaGroupSetting -GroupId "ab6a3887-776a-4db7-9da4-ea2b0d63c504"

Read all directory settings values of a specific directory settings object, using Settings ID GUID:

(Get-MgBetaDirectorySetting -DirectorySettingId "c391b57d-5783-4c53-9236-cefb5c6ef323").values

This cmdlet returns the names and values in this settings object for this specific group:

Name                          Value
----                          -----
ClassificationDescriptions
DefaultClassification
PrefixSuffixNamingRequirement
CustomBlockedWordsList        
AllowGuestsToBeGroupOwner     False 
AllowGuestsToAccessGroups     True
GuestUsageGuidelinesUrl
GroupCreationAllowedGroupId
AllowToAddGuests              True
UsageGuidelinesUrl            https://guideline.example.com
ClassificationList
EnableGroupCreation           True

Remove settings at the directory level

This step removes settings at directory level, which apply to all Office groups in the directory.

Remove-MgBetaDirectorySetting –DirectorySettingId "c391b57d-5783-4c53-9236-cefb5c6ef323c"

Create settings for a specific group

Get the settings templates.
```
Get-MgBetaDirectorySettingTemplate
```

In the results, find for the settings template named "Groups.Unified.Guest":

Id                                   DisplayName            Description
--                                   -----------            -----------
62375ab9-6b52-47ed-826b-58e47e0e304b Group.Unified          ...
08d542b9-071f-4e16-94b0-74abb372e3d9 Group.Unified.Guest    Settings for a specific Microsoft 365 group
4bc7f740-180e-4586-adb6-38b2e9024e6b Application            ...
898f1161-d651-43d1-805c-3b0b388a9fc2 Custom Policy Settings ...
5cf42378-d67d-4f36-ba46-e8b86229381d Password Rule Settings ...

Retrieve the template object for the Groups.Unified.Guest template:

$Template1 = Get-MgBetaDirectorySettingTemplate | where -Property Id -Value "08d542b9-071f-4e16-94b0-74abb372e3d9" -EQ

Get the ID of the group you want to apply this setting to:

$GroupId = (Get-MgGroup -Filter "DisplayName eq '<YourGroupName>'").Id

Create the new setting:

$params = @{
   templateId = "08d542b9-071f-4e16-94b0-74abb372e3d9"
   values = @(
      @{
         name = "AllowToAddGuests"
         value = "False"
      }
   )
}

Create the group setting:

New-MgBetaGroupSetting -GroupId $GroupId -BodyParameter $params

To verify the settings, run this command:

Get-MgBetaGroupSetting -GroupId $GroupId | FL Values

Update settings for a specific group

Get the ID of the group whose setting you want to update:

$groupId = (Get-MgGroup -Filter "DisplayName eq '<YourGroupName>'").Id

Retrieve the setting of the group:

$Setting = Get-MgBetaGroupSetting -GroupId $GroupId

Update the setting of the group as you need:

$params = @{
   values = @(
      @{
         name = "AllowToAddGuests"
         value = "True"
      }
   )
}

Then you can set the new value for this setting:

Update-MgBetaGroupSetting -DirectorySettingId $Setting.Id -GroupId $GroupId -BodyParameter $params

You can read the value of the setting to make sure it has been updated correctly:
```
Get-MgBetaGroupSetting -GroupId $GroupId  | FL Values
```

Cmdlet syntax reference

You can find more Microsoft Graph PowerShell documentation at Microsoft Entra Cmdlets.

Manage group settings using Microsoft Graph

To configure and manage group settings using Microsoft Graph, see the groupSetting resource type and its associated methods.

Share via