Managing M365 Group Resources

Question

I'm looking to use M365 groups to support the deployment of Sensitivity Labels. M365 groups are my only option as I need the group membership to be dynamic.

As you'll know, when you create an M365 group you get alot of 365 resources created at the same time e.g mailbox, sharepoint etc.

Now, none of these resources are needed and as the group will include 10s of 1000s of user, I don't want them using the group resources.

Looking at the Set-UnifiedGroup command I see there is an option for -IsMemberAllowedToEditContent https://learn.microsoft.com/en-us/powershell/module/exchange/set-unifiedgroup?view=exchange-ps#-ismemberallowedtoeditcontent

However, there's no actual description of what this option does. Does it restrict content within everything (Sharepoint, OneNote, Mailbox etc)?

Searching online, there's nothing to explain what this command does. Asking copilot results in an answer with no cited references.

Answer 1

This parameter only affects mailbox items. There is no way to prevent the provisioning of all the Group's resources, if that's what you are after. And there is no (supported) way to restrict member's access to them, apart from small bits and pieces here and there.

For your scenario, consider hiding the Group from the GAL, so members don't actually see it along with the -HiddenFromExchangeClientsEnabled flag.