Microsoft Entra cmdlets for configuring group settings

This article contains instructions for using PowerShell cmdlets to create and update groups in Microsoft Entra ID, part of Microsoft Entra. This content applies only to Microsoft 365 groups.

For more information on how to prevent nonadministrator users from creating security groups, set the AllowedToCreateSecurityGroups property to False as described in Update-MgPolicyAuthorizationPolicy.

Microsoft 365 groups settings are configured using a Settings object and a SettingsTemplate object. Initially, you don't see any Settings objects in your directory, because your directory is configured with the default settings. To change the default settings, you must create a new settings object using a settings template. Microsoft provides several settings templates. To configure Microsoft 365 group settings for your directory, you use the template named "Group.Unified". To configure Microsoft 365 group settings on a single group, use the template named "Group.Unified.Guest This template is used to manage guest access to a Microsoft 365 group.

The cmdlets are part of the Microsoft Graph PowerShell module. For instructions how to download and install the module on your computer, see Install the Microsoft Graph PowerShell SDK.

Install PowerShell cmdlets

Install the Microsoft Graph cmdlets as described in Install the Microsoft Graph PowerShell SDK.

1. Open the Windows PowerShell app as an administrator.

2. Install the Microsoft Graph cmdlets.

   Install-Module Microsoft.Graph -Scope AllUsers
   

3. Install the Microsoft Graph beta cmdlets.

   Install-Module Microsoft.Graph.Beta -Scope AllUsers
   

Create settings at the directory level

These steps create settings at directory level, which apply to all Microsoft 365 groups in the directory.

1. In the DirectorySettings cmdlets, you must specify the ID of the SettingsTemplate you want to use. If you don't know this ID, this cmdlet returns the list of all settings templates:

   Get-MgBetaDirectorySettingTemplate
   

   This cmdlet call returns all templates that are available:

   Id                                   DisplayName         Description
   --                                   -----------         -----------
   62375ab9-6b52-47ed-826b-58e47e0e304b Group.Unified       ...
   08d542b9-071f-4e16-94b0-74abb372e3d9 Group.Unified.Guest Settings for a specific Microsoft 365 group
   16933506-8a8d-4f0d-ad58-e1db05a5b929 Company.BuiltIn     Setting templates define the different settings that can be used for the associ...
   4bc7f740-180e-4586-adb6-38b2e9024e6b Application...
   898f1161-d651-43d1-805c-3b0b388a9fc2 Custom Policy       Settings ...
   5cf42378-d67d-4f36-ba46-e8b86229381d Password Rule       Settings ...
   

2. To add a usage guideline URL, first you need to get the SettingsTemplate object that defines the usage guideline URL value; that is, the Group. Unified template:

   $TemplateId = (Get-MgBetaDirectorySettingTemplate | where { $_.DisplayName -eq "Group.Unified" }).Id
   $Template = Get-MgBetaDirectorySettingTemplate | where -Property Id -Value $TemplateId -EQ
   

3. Create an object that contains values to be used for the directory setting. These values change the usage guideline value and enable sensitivity labels. Set these or any other setting in the template as required:

   $params = @{
      templateId = "$TemplateId"
      values = @(
         @{
            name = "UsageGuidelinesUrl"
            value = "https://guideline.example.com"
         }
         @{
            name = "EnableMIPLabels"
            value = "True"
         }
      )
   }
   

4. Create the directory setting by using the New-MgBetaDirectorySetting:

   New-MgBetaDirectorySetting -BodyParameter $params
   

5. You can read the values by using the following commands:

   $Setting = Get-MgBetaDirectorySetting | where { $_.DisplayName -eq "Group.Unified"}
   $Setting.Values
   

Update settings at the directory level

To update the value for UsageGuideLinesUrl in the setting template, read the current settings from Microsoft Entra ID, otherwise we could end up overwriting existing settings other than the UsageGuideLinesUrl.

1. Get the current settings from the Group.Unified SettingsTemplate:

   $Setting = Get-MgBetaDirectorySetting | where { $_.DisplayName -eq "Group.Unified"}
   

2. Check the current settings:

   $Setting.Values
   

   This command returns the following values:

   Name                            Value
   ----                            -----
   EnableMIPLabels                 True
   CustomBlockedWordsList
   EnableMSStandardBlockedWords    False
   ClassificationDescriptions
   DefaultClassification
   PrefixSuffixNamingRequirement
   AllowGuestsToBeGroupOwner       False
   AllowGuestsToAccessGroups       True
   GuestUsageGuidelinesUrl
   GroupCreationAllowedGroupId
   AllowToAddGuests                True
   UsageGuidelinesUrl              https://guideline.example.com
   ClassificationList
   EnableGroupCreation             True
   NewUnifiedGroupWritebackDefault True
   

3. To remove the value of UsageGuideLinesUrl, edit the URL to be an empty string:

   $params = @{
      Values = @(
         @{
            Name = "UsageGuidelinesUrl"
            Value = ""
         }
      )
   }
   

4. Update the value by using the Update-MgBetaDirectorySetting cmdlet:

   Update-MgBetaDirectorySetting -DirectorySettingId $Setting.Id -BodyParameter $params
   

Template settings

Here are the settings defined in the Group.Unified SettingsTemplate. Unless otherwise indicated, these features require a Microsoft Entra ID P1 license.

Example: Configure Guest policy for groups at the directory level

1. Get all the setting templates:

   Get-MgBetaDirectorySettingTemplate
   

2. To set guest policy for groups at the directory level, you need the Group.Unified template.

   $Template = Get-MgBetaDirectorySettingTemplate | where -Property Id -Value "62375ab9-6b52-47ed-826b-58e47e0e304b" -EQ
   

3. Set a value for AllowToAddGuests for the specified template:

   $params = @{
      templateId = "62375ab9-6b52-47ed-826b-58e47e0e304b"
      values = @(
         @{
            name = "AllowToAddGuests"
            value = "False"
         }
      )
   }
   

4. Next, create a new settings object by using the New-MgBetaDirectorySetting cmdlet:

   $Setting = New-MgBetaDirectorySetting -BodyParameter $params
   

5. You can read the values using:

   $Setting.Values
   

Read settings at the directory level

If you know the name of the setting you want to retrieve, you can use the below cmdlet to retrieve the current settings value. In this example, we're retrieving the value for a setting named UsageGuidelinesUrl.

(Get-MgBetaDirectorySetting).Values | where -Property Name -Value UsageGuidelinesUrl -EQ

These steps read settings at directory level, which apply to all Office groups in the directory.

1. Read all existing directory settings:

   Get-MgBetaDirectorySetting -All
   

   This cmdlet returns a list of all directory settings:

   Id                                   DisplayName   TemplateId                           Values
   --                                   -----------   ----------                           ------
   c391b57d-5783-4c53-9236-cefb5c6ef323 Group.Unified 62375ab9-6b52-47ed-826b-58e47e0e304b {class SettingValue {...
   

2. Read all settings for a specific group:

   Get-MgBetaGroupSetting -GroupId "ab6a3887-776a-4db7-9da4-ea2b0d63c504"
   

3. Read all directory settings values of a specific directory settings object, using Settings ID GUID:

   (Get-MgBetaDirectorySetting -DirectorySettingId "c391b57d-5783-4c53-9236-cefb5c6ef323").values
   

   This cmdlet returns the names and values in this settings object for this specific group:

   Name                          Value
   ----                          -----
   ClassificationDescriptions
   DefaultClassification
   PrefixSuffixNamingRequirement
   CustomBlockedWordsList        
   AllowGuestsToBeGroupOwner     False 
   AllowGuestsToAccessGroups     True
   GuestUsageGuidelinesUrl
   GroupCreationAllowedGroupId
   AllowToAddGuests              True
   UsageGuidelinesUrl            https://guideline.example.com
   ClassificationList
   EnableGroupCreation           True
   

Remove settings at the directory level

This step removes settings at directory level, which apply to all Office groups in the directory.

Remove-MgBetaDirectorySetting –DirectorySettingId "c391b57d-5783-4c53-9236-cefb5c6ef323c"

Create settings for a specific group

1. Get the settings templates.

   Get-MgBetaDirectorySettingTemplate
   

2. In the results, find for the settings template named "Groups.Unified.Guest":

   Id                                   DisplayName            Description
   --                                   -----------            -----------
   62375ab9-6b52-47ed-826b-58e47e0e304b Group.Unified          ...
   08d542b9-071f-4e16-94b0-74abb372e3d9 Group.Unified.Guest    Settings for a specific Microsoft 365 group
   4bc7f740-180e-4586-adb6-38b2e9024e6b Application            ...
   898f1161-d651-43d1-805c-3b0b388a9fc2 Custom Policy Settings ...
   5cf42378-d67d-4f36-ba46-e8b86229381d Password Rule Settings ...
   

3. Retrieve the template object for the Groups.Unified.Guest template:

   $Template1 = Get-MgBetaDirectorySettingTemplate | where -Property Id -Value "08d542b9-071f-4e16-94b0-74abb372e3d9" -EQ
   

4. Get the ID of the group you want to apply this setting to:

   $GroupId = (Get-MgGroup -Filter "DisplayName eq '<YourGroupName>'").Id
   

5. Create the new setting:

   $params = @{
      templateId = "08d542b9-071f-4e16-94b0-74abb372e3d9"
      values = @(
         @{
            name = "AllowToAddGuests"
            value = "False"
         }
      )
   }
   

6. Create the group setting:

   New-MgBetaGroupSetting -GroupId $GroupId -BodyParameter $params
   

7. To verify the settings, run this command:

   Get-MgBetaGroupSetting -GroupId $GroupId | FL Values
   

Update settings for a specific group

1. Get the ID of the group whose setting you want to update:

   $groupId = (Get-MgGroup -Filter "DisplayName eq '<YourGroupName>'").Id
   

2. Retrieve the setting of the group:

   $Setting = Get-MgBetaGroupSetting -GroupId $GroupId
   

3. Update the setting of the group as you need:

   $params = @{
      values = @(
         @{
            name = "AllowToAddGuests"
            value = "True"
         }
      )
   }
   

4. Then you can set the new value for this setting:

   Update-MgBetaGroupSetting -DirectorySettingId $Setting.Id -GroupId $GroupId -BodyParameter $params
   

5. You can read the value of the setting to make sure it has been updated correctly:

   Get-MgBetaGroupSetting -GroupId $GroupId  | FL Values
   

Cmdlet syntax reference

You can find more Microsoft Graph PowerShell documentation at Microsoft Entra Cmdlets.

Manage group settings using Microsoft Graph

To configure and manage group settings using Microsoft Graph, see the groupSetting resource type and its associated methods.

Additional reading

• Managing access to resources with Microsoft Entra groups
• Integrating your on-premises identities with Microsoft Entra ID