What it does

Teams doesn't have its own creation, naming or lifecycle controls — every team is a Microsoft 365 group, so you govern teams with the Entra group settings: restrict who can create groups, apply a prefix/suffix and blocked-words naming policy, and set a group expiration policy that renews active teams and soft-deletes the dead ones.

Key facts

• By default, every user can create Microsoft 365 groups and therefore teams. Restricting it uses the Group.Unified directory setting: EnableGroupCreation set to False and GroupCreationAllowedGroupId pointing at the group whose members may still create. It's configured with Microsoft Graph PowerShell (beta directory setting cmdlets), not the Teams module.
• The restriction hits every workload that creates groups — Teams, Outlook, SharePoint, Planner, Viva Engage, Power BI (classic), Project for the web. Changes can take 30 minutes or more to apply.
• Admin roles bypass it, including Global Administrator, Teams Service Administrator (Teams Administrator), Exchange Administrator, SharePoint Administrator, User Administrator, Groups Administrator and Directory Writers.
• Naming policy is Prefix[GroupName]Suffix, using fixed strings and/or user attributes: [Department], [Company], [Office], [StateOrProvince], [CountryOrRegion], [Title]. The full name is capped at 63 characters. Global Administrator and User Administrator are exempt.
• Custom blocked words: up to 5,000 phrases, not case-sensitive, exact match only — no substring matching.
• Expiration policy: lifetime of 30 days or more, applied to all groups or to up to 500 selected groups. There's one expiration policy per tenant.
• Groups auto-renew if there's activity; for Teams, a member visiting a channel counts. Owners of inactive groups get notices 30, 15 and 1 day before expiry and can renew from team settings.
• Unrenewed groups are deleted a day after expiry and can be restored for 30 days (not configurable). After a renewal, the team and group expiry dates can take up to 24 hours to match.
• Licensing: creation restriction, naming policy and expiration all need Microsoft Entra ID P1 (or Entra Basic EDU) for the users concerned — possessed in the tenant, not necessarily assigned.
• When expiration is first switched on, groups already older than the lifetime get 35 days before they expire.

When to use / skip

Naming policy and expiration are worth turning on in most enterprises once Teams has been running a while and the sprawl is visible. Expiration with activity-based renewal is low-risk: anything used gets renewed without anyone noticing, and the rest goes to the recycle bin with 30 days to change your mind. Naming policy is worth it if the client actually has a convention people will recognise — a prefix that means nothing to users just adds clutter to every team name.

Restricting creation is where I'd push back. Locking it down to a small IT group nearly always produces a request backlog, then shadow workarounds — people reuse unsuitable teams or move into personal chats. A request process with a provisioning flow (templates, naming, owners set properly) is better than a hard block. Only fully lock it down when the client has a real compliance driver and has staffed the request process.

Configuration decisions

• Open creation, restricted creation, or restricted creation fronted by a self-service request flow.
• Which group controls creation rights, and who owns its membership.
• Naming convention: department attribute, a fixed prefix by team type, or nothing. Check attribute data quality before using [Department] or [Office].
• Blocked words list: brand terms, roles like "CEO" or "HR", offensive terms. Keep it short and purposeful.
• Expiration lifetime (180 and 365 days are typical) and whether it applies to all groups or a pilot set first.
• An alternate notification address for ownerless groups, so expiry notices don't go nowhere.

Gotchas

• Every Entra group control here is tenant-wide across Microsoft 365. Restricting creation for Teams also blocks Planner plans and Outlook groups — tell the client before it lands, not after.
• Naming policy only applies to existing groups when an owner next edits the group name. Old teams keep their old names until someone touches them.
• If any user has an empty attribute used in the naming policy, the team name comes out odd. Check the data first.
• The 500-group limit applies only when targeting selected groups. Plan the "all groups" switch from the start rather than finding out mid-pilot.
• Ownerless teams get no expiry email unless you've set an alternate notification address, so they just disappear after expiry.
• Activity-based renewal is coarse — a single channel visit keeps a team alive. Expiration cuts the obviously abandoned teams, not the barely used ones.
• Retention policies keep content regardless of group deletion, and group mailboxes on hold are kept. Don't sell expiration as a data-disposal mechanism.

Consultant notes

• Run a quick inventory first: number of teams, ownerless teams, single-owner teams, last activity. The numbers usually make the governance case on their own.
• Pilot expiration on a set of selected groups before switching to all; you'll learn how many owners actually respond to notices.
• Pair expiration with an ownership policy (at least two owners) and a report on ownerless teams — the Teams admin center and Microsoft 365 group settings help, but someone has to act on it.
• Where creation is restricted, put the request process in place on day one with a clear turnaround time, or the restriction will be reversed within a quarter.
• Check Entra ID P1 coverage with the client's licensing contact rather than assuming it — most E3/E5 estates have it, smaller Business tenants vary.

---

Worth revisiting if Microsoft adds Teams-specific lifecycle controls or changes what counts as activity for renewal