I have give all users of my tenant "Restricted Read" permissions on the root site collection so that they cannot create site collections and sub-sites in the tenant. When any such user logs into the sharepoint site, s/he cannot see the SharePoint link in the top bar that navigates to SharePoint page.
However when the user types in the browser window the direct URL:
s/he can navigate to the page and can see the "Create Site" link at the top. Although s/he cannot create a site, but can still see the option. Am I missing adding/removing any specific permission or this is an expected bahvior?