Skip to content

Commit fb75808

Browse files
jomolnarjomolnar
authored
Merge pull request MicrosoftDocs#1079 from RobdeJong/patch-6
Update active-directory-accessmanagement-groups-settings-cmdlets.md
2 parents 6a2a307 + 2bae8fb commit fb75808

File tree

1 file changed

+126
-47
lines changed

1 file changed

+126
-47
lines changed

‎articles/active-directory/active-directory-accessmanagement-groups-settings-cmdlets.md‎

Lines changed: 126 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -18,104 +18,183 @@ ms.author: curtand
1818

1919
---
2020
# Azure Active Directory cmdlets for configuring group settings
21-
The following settings for unified groups can be configured in your directory:
2221

23-
1. Classifications: the comma-separated list of classifications that users can set on a group. Examples would be “Classified”, “Secret”, and “Top Secret.”
24-
2. Usage Guidelines URL: a URL that points users to the terms of use for using Unified Groups, as defined by your organization. This URL will show up in the user interface where users use groups.
25-
3. Group creation enabled: whether none, some or all users are allowed to create Unified Groups. When set to on, all users can create groups. When set to off, no users can create groups. When off, you can also specify a security group whose users who are still allowed to create groups.
22+
Note: This content only applies to Unified groups, also know as Office365 Groups.
2623

27-
These settings are configured using a Settings and SettingsTemplate objects. Initially, you will not see any Settings objects in your directory. This means your directory is configured with the default settings. To change the default settings, you will create a new settings object using a settings template. Settings templates are defined by Microsoft.
24+
Office365 Groups settings are configured using a Settings object and a SettingsTemplate object. Initially, you will not see any Settings objects in your directory. This means your directory is configured with the default settings. To change the default settings, you will need to create a new settings object using a settings template. Settings templates are defined by Microsoft. There are several different settings templates. To configure group settings for your directory, you will use the template named "Group.Unified". To configure group settings on a single group you will use the template named "Group.Unified.Guest". This template is used to manage guest access to a group.
2825

29-
You can download the module containing the cmdlets used for these operations from the [Microsoft Connect site](http://connect.microsoft.com/site1164/Downloads/DownloadDetails.aspx?DownloadID=59185).
26+
The cmdlets are part of the Azure Active Directory PowerShell V2 Module. For more information about this module and for instructions how to download and install the module on your computer, please refer to [Azure Active Directory PowerShell Version 2](https://docs.microsoft.com/en-us/powershell/azuread/).
3027

3128
## Create settings at the directory level
32-
These steps create settings at directory level, which apply to all Office groups in the directory.
29+
These steps create settings at directory level, which apply to all Unified groups in the directory.
3330

34-
1. If you do not know which SettingTemplate to use, this cmdlet returns the list of settings templates:
31+
1. In the DirectorySettings cmdlets you will need to specify the Id of the SettingsTemplate you want to use. If you do not know this ID, this cmdlet returns the list of all settings templates:
3532

36-
`Get-MsolAllSettingTemplate`
33+
`PS C:> Get-AzureADDirectorySettingTemplate'
3734

38-
![List of settings templates](./media/active-directory-accessmanagement-groups-settings-cmdlets/list-of-templates.png)
35+
This cmdlet call will return all templates that are available:
36+
37+
'
38+
Id DisplayName Description
39+
-- ----------- -----------
40+
62375ab9-6b52-47ed-826b-58e47e0e304b Group.Unified ...
41+
08d542b9-071f-4e16-94b0-74abb372e3d9 Group.Unified.Guest Settings for a specific Unified Group
42+
16933506-8a8d-4f0d-ad58-e1db05a5b929 Company.BuiltIn Setting templates define the different settings that can be used for the associ...
43+
4bc7f740-180e-4586-adb6-38b2e9024e6b Application...
44+
898f1161-d651-43d1-805c-3b0b388a9fc2 Custom Policy Settings ...
45+
5cf42378-d67d-4f36-ba46-e8b86229381d Password Rule Settings ...
46+
`
3947
2. To add a usage guideline URL, first you need to get the SettingsTemplate object that defines the usage guideline URL value; that is, the Group.Unified template:
4048

41-
`$template = Get-MsolSettingTemplate –TemplateId 62375ab9-6b52-47ed-826b-58e47e0e304b`
49+
`$Template = Get-AzureADDirectorySettingTemplate -Id 62375ab9-6b52-47ed-826b-58e47e0e304b`
4250
3. Next, create a new settings object based on that template:
4351

44-
`$setting = $template.CreateSettingsObject()`
52+
`$Setting = $template.CreateDirectorySetting()`
4553
4. Then update the usage guideline value:
4654

4755
`$setting["UsageGuidelinesUrl"] = "<https://guideline.com>"`
4856
5. Finally, apply the settings:
4957

50-
`New-MsolSettings –SettingsObject $setting`
58+
`New-AzureADDirectorySetting -DirectorySetting $settings'
59+
60+
Upon successful completion, the cmdlet returns the Id of the new settings object:
61+
62+
'
63+
Id DisplayName TemplateId Values
64+
-- ----------- ---------- ------
65+
c391b57d-5783-4c53-9236-cefb5c6ef323 62375ab9-6b52-47ed-826b-58e47e0e304b {class SettingValue {...`
5166

52-
![Add a usage guideline URL](./media/active-directory-accessmanagement-groups-settings-cmdlets/add-usage-guideline-url.png)
5367

5468
Here are the settings defined in the Group.Unified SettingsTemplate.
5569

5670
| **Setting** | **Description** |
5771
| --- | --- |
58-
| <ul><li>ClassificationList<li>Type: String<li>Default: “” |A comma-delimited list of valid classification values that can be applied to Unified Groups. |
5972
| <ul><li>EnableGroupCreation<li>Type: Boolean<li>Default: True |The flag indicating whether Unified Group creation is allowed in the directory. |
60-
| <ul><li>GroupCreationAllowedGroupId<li>Type: String<li>Default: “” |GUID of the security group that is allowed to create Unified Groups even when EnableGroupCreation == false. |
73+
| <ul><li>GroupCreationAllowedGroupId<li>Type: String<li>Default: “” |GUID of the security group for which the members are allowed to create Unified Groups even when EnableGroupCreation == false. |
6174
| <ul><li>UsageGuidelinesUrl<li>Type: String<li>Default: “” |A link to the Group Usage Guidelines. |
75+
| <ul><li>ClassificationDescriptions<li>Type: String<li>Default: “” | A comma-delimited list of classification descriptions. |
76+
| <ul><li>DefaultClassification<li>Type: String<li>Default: “” | The classification that is to be used as the default classification for a group if none was specified.|
77+
| <ul><li>PrefixSuffixNamingRequirement<li>Type: String<li>Default: “” |Not implemented yet
78+
| <ul><li>AllowGuestsToBeGroupOwner<li>Type: Boolean<li>Default: False | Boolean indicating whether or not a guest user can be an owner of groups. |
79+
| <ul><li>AllowGuestsToAccessGroups<li>Type: Boolean<li>Default: True | Boolean indicating whether or not a guest user can have access to Unified groups' content. |
80+
| <ul><li>GuestUsageGuidelinesUrl<li>Type: String<li>Default: “” | The url of a link to the guest usage guidelines. |
81+
| <ul><li>AllowToAddGuests<li>Type: Boolean<li>Default: True | A boolean indicating whether or not is is allowed to add guests to this directory.|
82+
| <ul><li>ClassificationList<li>Type: String<li>Default: “” |A comma-delimited list of valid classification values that can be applied to Unified Groups. |
83+
| <ul><li>EnableGroupCreation<li>Type: Boolean<li>Default: True | A boolean indicating whether or not non-admin users can create new Unified groups. |
84+
'
6285

6386
## Read settings at the directory level
6487
These steps read settings at directory level, which apply to all Office groups in the directory.
6588

6689
1. Read all existing directory settings:
6790

68-
`Get-MsolAllSettings`
91+
`Get-AzureADDirectorySetting -All $True'
92+
93+
This cmdlet returns a list of all directory settings:
94+
'
95+
Id DisplayName TemplateId Values
96+
-- ----------- ---------- ------
97+
c391b57d-5783-4c53-9236-cefb5c6ef323 Group.Unified 62375ab9-6b52-47ed-826b-58e47e0e304b {class SettingValue {...`
98+
99+
69100
2. Read all settings for a specific group:
70101

71-
`Get-MsolAllSettings -TargetType Groups -TargetObjectId <groupObjectId>`
72-
3. Read specific directory settings, using SettingId GUID:
102+
`Get-AzureADObjectSetting -TargetObjectId ab6a3887-776a-4db7-9da4-ea2b0d63c504 -TargetType Groups`
103+
104+
3. Read all directory settings values of a specific directory settings object, using Settings Id GUID:
105+
106+
`(Get-AzureADDirectorySetting -Id c391b57d-5783-4c53-9236-cefb5c6ef323).values'
107+
108+
This cmdlet returns the names and values in this settings object for this specific group:
109+
'
110+
Name Value
111+
---- -----
112+
ClassificationDescriptions
113+
DefaultClassification
114+
PrefixSuffixNamingRequirement
115+
AllowGuestsToBeGroupOwner False
116+
AllowGuestsToAccessGroups True
117+
GuestUsageGuidelinesUrl
118+
GroupCreationAllowedGroupId
119+
AllowToAddGuests True
120+
UsageGuidelinesUrl <https://guideline.com>
121+
ClassificationList
122+
EnableGroupCreation True`
123+
'
124+
125+
## Update settings for a specific group
126+
127+
1. Search for the settings template named "Groups.Unified.Guest"
128+
129+
'Get-AzureADDirectorySettingTemplate
73130

74-
`Get-MsolSettings –SettingId dbbcb0ea-a6ff-4b44-a1f3-9d7cef74984c`
131+
Id DisplayName Description
132+
-- ----------- -----------
133+
62375ab9-6b52-47ed-826b-58e47e0e304b Group.Unified ...
134+
08d542b9-071f-4e16-94b0-74abb372e3d9 Group.Unified.Guest Settings for a specific Unified Group
135+
4bc7f740-180e-4586-adb6-38b2e9024e6b Application ...
136+
898f1161-d651-43d1-805c-3b0b388a9fc2 Custom Policy Settings ...
137+
5cf42378-d67d-4f36-ba46-e8b86229381d Password Rule Settings ...
138+
'
139+
2. Retrieve the template object for the Groups.Unified.Guest template:
140+
'
141+
$Template = Get-AzureADDirectorySettingTemplate -Id 08d542b9-071f-4e16-94b0-74abb372e3d9
142+
'
143+
3. Create a new settings object from the template:
75144

76-
![Settings ID GUID](./media/active-directory-accessmanagement-groups-settings-cmdlets/settings-id-guid.png)
145+
'
146+
$Setting = $Template.CreateDirectorySetting()
147+
'
148+
149+
4. Set the setting to the required value:
150+
151+
'
152+
$Setting["AllowToAddGuests"]=$False
153+
'
154+
155+
6. Create the new setting for the required group in the directory:
156+
157+
'
158+
New-AzureADObjectSetting -TargetType Groups -TargetObjectId ab6a3887-776a-4db7-9da4-ea2b0d63c504 -DirectorySetting $Setting
159+
160+
161+
Id DisplayName TemplateId Values
162+
-- ----------- ---------- ------
163+
25651479-a26e-4181-afce-ce24111b2cb5 08d542b9-071f-4e16-94b0-74abb372e3d9 {class SettingValue {...
164+
'
77165

78166
## Update settings at the directory level
79-
These steps update settings at directory level, which apply to all Office groups in the directory.
80167

81-
1. Get the existing Settings object:
168+
These steps update settings at directory level, which apply to all Unified groups in the directory. These examples assume there is already a Settings object in your directory.
169+
170+
1. Find the existing Settings object:
82171

83-
`$setting = Get-MsolSettings –SettingId dbbcb0ea-a6ff-4b44-a1f3-9d7cef74984c`
84-
2. Get the value you want to update:
172+
'Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ
173+
174+
'Id DisplayName TemplateId Values
175+
-- ----------- ---------- ------
176+
c391b57d-5783-4c53-9236-cefb5c6ef323 Group.Unified 62375ab9-6b52-47ed-826b-58e47e0e304b {class SettingValue {...
177+
'
178+
179+
`$setting = Get-AzureADDirectorySetting –Id c391b57d-5783-4c53-9236-cefb5c6ef323`
85180

86-
`$value = $Setting.GetSettingsValue()`
87181
3. Update the value:
88182

89-
`$value["AllowToAddGuests"] = "false"`
183+
`$Setting["AllowToAddGuests"] = "false"`
184+
90185
4. Update the setting:
91186

92-
`Set-MsolSettings –SettingId dbbcb0ea-a6ff-4b44-a1f3-9d7cef74984c –SettingsValue $value`
187+
'Set-AzureADDirectorySetting -Id c391b57d-5783-4c53-9236-cefb5c6ef323 -DirectorySetting $Setting'
93188

94189
## Remove settings at the directory level
95190
This step removes settings at directory level, which apply to all Office groups in the directory.
96191

97-
`Remove-MsolSettings –SettingId dbbcb0ea-a6ff-4b44-a1f3-9d7cef74984c`
192+
`Remove-AzureADDirectorySetting –Id c391b57d-5783-4c53-9236-cefb5c6ef323c`
98193

99194
## Cmdlet syntax reference
100-
You can find more Azure Active Directory PowerShell documentation at [Azure Active Directory Cmdlets](http://go.microsoft.com/fwlink/p/?LinkId=808260).
101-
102-
## SettingsTemplate object reference (Group.Unified SettingsTemplate object)
103-
* "name": "EnableGroupCreation", "type": "System.Boolean", "defaultValue": "true", "description": "A boolean flag indicating if the Unified Group creation feature is on."
104-
* "name": "GroupCreationAllowedGroupId", "type": "System.Guid", "defaultValue": "", "description": "GUID of the security group that is whitelisted to create Unified Groups."
105-
* "name": "ClassificationList", "type": "System.String", "defaultValue": "", "description": "A comma-delimited list of valid classification values that can be applied to Unified Groups."
106-
* "name": "UsageGuidelinesUrl", "type": "System.String", "defaultValue": "", "description": "A link to the Group Usage Guidelines."
107-
108-
| name | type | defaultValue | description |
109-
| --- | --- | --- | --- |
110-
| "EnableGroupCreation" |"System.Boolean" |"true" |"A boolean flag indicating if the Unified Group creation feature is on." |
111-
| "GroupCreationAllowedGroupId" |"System.Guid" |"" |"GUID of the security group that is whitelisted to create Unified Groups." |
112-
| "ClassificationList" |"System.String" |"" |"A comma-delimited list of valid classification values that can be applied to Unified Groups." |
113-
| "UsageGuidelinesUrl" |"System.String" |"" |"A link to the Group Usage Guidelines." |
114-
115-
## Next steps
116-
You can find more Azure Active Directory PowerShell documentation at [Azure Active Directory Cmdlets](http://go.microsoft.com/fwlink/p/?LinkId=808260).
195+
You can find more Azure Active Directory PowerShell documentation at [Azure Active Directory Cmdlets](https://docs.microsoft.com/en-us/powershell/azuread/).
117196

118-
Additional instruction from Microsoft program manager Rob de Jong is available at [Rob's Groups Blog](http://robsgroupsblog.com/blog/configuring-settings-for-office-365-groups-in-azure-ad).
197+
## Additional reading
119198

120199
* [Managing access to resources with Azure Active Directory groups](active-directory-manage-groups.md)
121200
* [Integrating your on-premises identities with Azure Active Directory](active-directory-aadconnect.md)

0 commit comments

Comments
 (0)