4

We are seeing SharePoint Online site collections being created in our tenant by users who create Microsoft Teams areas/groups. Teams automatically creates a site collection. We want to apply governance to who can create site collections within our tenant but that doesn't seem to be possible.

We noticed these sites only after putting in an alert that surfaced when these sites were being created.

We do not officially use Microsoft Teams yet but it seems to be a security hole that allows non-admins to create site collections.

How can we only allow tenant admins to create site collections?

0

Follow the guide How to prevent users from creating and managing distribution groups in Office 365

Step 1: Edit the default role assignment policy or create a new role assignment policy Depending on the particular scenario and the kind of organization, Exchange Online admins have two options for using a role assignment policy to control whether users can create and manage distribution groups. These options are as follows: If you want to apply the policy to all users in your organization, edit the default role assignment policy. If you have already created several role assignment policies or if you only want to disable this feature for a subset of users in your organization, create a new role assignment policy. Do one of the following things, as appropriate for your situation: Edit the default role assignment policy

To edit the default role assignment policy, follow these steps: Sign in to the Office 365 portal as an admin, click Admin, and then click Exchange to open the Exchange admin center. In the left navigation pane click permissions, and then click user roles. Double-click Default Role Assignment Policy. Click to clear the MyDistributionGroups check box and the MyDistributionGroupMembership check box. Click Save. Create a new role assignment policy

To create a new role assignment policy, follow these steps: Sign in to the Office 365 portal as an admin, click Admin, and then click Exchange to open the Exchange admin center. In the left navigation pane click permissions, and then click user roles. Click New (A screen shot of the New icon ). Type a name for the new role assignment policy, and then click to select the options that you want. Make sure that the MyDistributionGroups check box and the MyDistributionGroupMembership check box are cleared. Click Save. Step 2: Apply the role assignment policy Important If you only use one role assignment policy in your organization, you don't have to follow this step.

After you set up the role assignment policy, apply the policy. Be aware that if you changed the default role assignment policy, you don't have to reapply it. However, if you created a new role assignment policy, you must apply it to users in your organization.

To apply the role assignment policy, use one of the following methods, as appropriate for your situation. Manually apply the role assignment policy to one user by using the Exchange admin center

To apply the role assignment policy to one user, follow these steps: Sign in to the Office 365 portal as an admin, click Admin, and then click Exchange to open the Exchange admin center. In the left navigation pane, click recipients, and then click mailboxes. Double-click the mailbox to which you want to apply the policy. In the mailbox details window, click mailbox features, and then in the Role assignment policy box, select the policy that you want to apply. Click Save. Apply the role assignment policy to all users by using remote PowerShell

To apply the role assignment policy to all users in the organization by using remote PowerShell, follow these steps: Connect to Exchange Online by using remote PowerShell. For more information about how to do this, see Connect to Exchange Online using remote PowerShell. At the PowerShell prompt, type the following command, and then press Enter:

Get-Mailbox | Set-Mailbox –RoleAssignmentPolicy “ <Name of
 Policy>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.