Enforce a naming policy on Microsoft 365 groups in Microsoft Entra ID

Alt
08/23/2024

To enforce consistent naming conventions for Microsoft 365 groups created or edited by your users, set up a group naming policy for your organizations in Microsoft Entra ID. For example, you could use the naming policy to communicate the function of a group, membership, geographic region, or person who created the group. You could also use the naming policy to help categorize groups in the address book. You can use the policy to block specific words from being used in group names and aliases.

Important

Using a Microsoft Entra ID naming policy for Microsoft 365 groups requires that you possess but not necessarily assign a Microsoft Entra ID P1 license or Microsoft Entra Basic EDU license for each unique user who's a member of one or more Microsoft 365 groups.

The naming policy is applied to creating or editing groups created across workloads, for example, Outlook, Microsoft Teams, SharePoint, Exchange, or Planner, even if no editing changes are made. It's applied to both the group name and group alias. If you set up your naming policy in Microsoft Entra ID and you have an existing Exchange group naming policy, the Microsoft Entra ID naming policy is enforced in your organization.

When a group naming policy is configured, the policy is applied to new Microsoft 365 groups created by users. A naming policy doesn't apply to certain directory roles, such as Global Administrator or User Administrator. (For the complete list of roles exempted from a group naming policy, see the "Roles and permissions" section.) For existing Microsoft 365 groups, the policy isn't immediately applied at the time of configuration. After a group owner edits the group name for these groups, the naming policy is enforced even if no changes are made.

Naming policy features

You can enforce a naming policy for groups in two different ways:

Prefix-suffix naming policy: You can define prefixes or suffixes that are then added automatically to enforce a naming convention on your groups. For example, in the group name GRP_JAPAN_My Group_Engineering, the prefix is GRP_JAPAN_ and the suffix is _Engineering.
Custom blocked words: You can upload a set of blocked words specific to your organization to be blocked in groups created by users. For example, you might use Payroll,CEO,HR.

Prefix-suffix naming policy

The general structure of the naming convention is Prefix[GroupName]Suffix. While you can define multiple prefixes and suffixes, you can have only one instance of the [GroupName] in the setting. The prefixes or suffixes can be either fixed strings or user attributes, such as [Department], that are substituted based on the user who's creating the group. The total allowable number of characters for your prefix and suffix strings including group name is 63 characters.

Prefixes and suffixes can contain special characters that are supported in a group name and a group alias. Any characters in the prefix or suffix that aren't supported in the group alias are still applied in the group name but removed from the group alias. Because of this restriction, the prefixes and suffixes applied to the group name might be different from the ones applied to the group alias.

Fixed strings

You can use strings to make it easier to scan and differentiate groups in the global address list and in the left navigation links of group workloads. Some of the common prefixes are keywords like Grp_Name, #Name, and _Name.

User attributes

You can use attributes that can help you and your users identify which department, office, or geographic region for which the group was created. For example, if you define your naming policy as PrefixSuffixNamingRequirement = "GRP [GroupName] [Department]" and User's department = Engineering, then an enforced group name might be "GRP My Group Engineering." Supported Microsoft Entra attributes are \[Department\], \[Company\], \[Office\], \[StateOrProvince\], \[CountryOrRegion\], and \[Title\]. Unsupported user attributes are treated as fixed strings. An example is "\[postalCode\]". Extension attributes and custom attributes aren't supported.

We recommend that you use attributes that have values filled in for all users in your organization and don't use attributes that have long values.

Custom blocked words

A blocked word list is a comma-separated list of phrases to be blocked in group names and aliases. No substring searches are performed. An exact match between the group name and one or more of the custom blocked words is required to trigger a failure. Substring search isn't performed so that users can use common words like "Class" even if "lass" is a blocked word.

Blocked word list rules:

Blocked words aren't case sensitive.
When a user enters a blocked word as part of a group name, they see an error message with the blocked word.
There are no character restrictions on blocked words.
There's an upper limit of 5,000 phrases that you can configure in the blocked words list.

Roles and permissions

To configure a naming policy, one of the following roles is required:

Global Administrator
Group Administrator
Directory Writer

Some administrator roles are exempted from these policies, across all group workloads and endpoints, so that they can create groups by using blocked words and with their own naming conventions. The following administrator roles are exempted from the group naming policy:

Global Administrator
User Administrator

Configure a naming policy

Sign in to the Microsoft Entra admin center as at least a Group Administrator.
Select Microsoft Entra ID.
Select All groups > Groups, and then select Naming policy to open the Naming policy page.

View or edit the prefix-suffix naming policy

On the Naming policy page, select Group naming policy.
You can view or edit the current prefix or suffix naming policies individually by selecting the attributes or strings you want to enforce as part of the naming policy.
To remove a prefix or suffix from the list, select the prefix or suffix, and then select Delete. You can delete multiple items at the same time.
Save your changes for the new policy to go into effect by selecting Save.

Edit custom blocked words

On the Naming policy page, select Blocked words.
View or edit the current list of custom blocked words by selecting Download. You must add new entries to the existing entries.
Upload the new list of custom blocked words by selecting the file icon.
Save your changes for the new policy to go into effect by selecting Save.

Install PowerShell cmdlets

Install the Microsoft Graph cmdlets as described in Install the Microsoft Graph PowerShell SDK.

Note

Azure AD and MSOnline PowerShell modules are deprecated as of March 30, 2024. To learn more, read the deprecation update. After this date, support for these modules are limited to migration assistance to Microsoft Graph PowerShell SDK and security fixes. The deprecated modules will continue to function through March, 30 2025.

We recommend migrating to Microsoft Graph PowerShell to interact with Microsoft Entra ID (formerly Azure AD). For common migration questions, refer to the Migration FAQ. Note: Versions 1.0.x of MSOnline may experience disruption after June 30, 2024.

Open the Windows PowerShell app as an administrator.

Install the Microsoft Graph cmdlets.

Install-Module Microsoft.Graph -Scope AllUsers

Install the Microsoft Graph beta cmdlets.

Install-Module Microsoft.Graph.Beta -Scope AllUsers

Configure a naming policy in PowerShell

Open a Windows PowerShell window on your computer. You can open it without elevated privileges.
Run the following command to prepare to run the cmdlets.
```
Connect-MgGraph -Scopes "Directory.ReadWrite.All"
```
On the Sign in to your Account screen that opens, enter your admin account and password to connect to your service.
Follow the steps in Microsoft Entra cmdlets for configuring group settings to create group settings for this organization.

View the current settings

Fetch the current naming policy to view the current settings.

$Setting = Get-MgBetaDirectorySetting -DirectorySettingId (Get-MgBetaDirectorySetting | where -Property DisplayName -Value "Group.Unified" -EQ).id

Display the current group settings.
```
$Setting.Values
```

Set the naming policy and custom blocked words

Get the setting.

$Setting = Get-MgBetaDirectorySetting -DirectorySettingId (Get-MgBetaDirectorySetting | where -Property DisplayName -Value "Group.Unified" -EQ).id

Set the group name prefixes and suffixes. For the feature to work properly, [GroupName] must be included in the setting. Also, set the custom blocked words that you want to restrict.

$params = @{
   values = @(
      @{
         name = "PrefixSuffixNamingRequirement"
         value = "GRP_[GroupName]_[Department]"
      }
      @{
         name = "CustomBlockedWordsList"
         value = "Payroll,CEO,HR"
      }
   )
}

Update the settings for the new policy to go into effect, as shown in the following example.
```
Update-MgBetaDirectorySetting -DirectorySettingId $Setting.Id -BodyParameter $params
```

That's it. You set your naming policy and added your blocked words.

Export or import custom blocked words

For more information, see Microsoft Entra cmdlets for configuring group settings.

Here's an example of a PowerShell script to export multiple blocked words.

$Words = (Get-MgBetaDirectorySetting).Values | where -Property Name -Value CustomBlockedWordsList -EQ 
Add-Content "c:\work\currentblockedwordslist.txt" -Value $Words.value.Split(",").Replace("`"","")

Here's an example PowerShell script to import multiple blocked words.

$BadWords = Get-Content "C:\work\currentblockedwordslist.txt"
$BadWords = [string]::join(",", $BadWords)
$Setting = Get-MgBetaDirectorySetting | where {$_.DisplayName -eq "Group.Unified"}
if ($Setting.Count -eq 0) {
   $Template = Get-MgBetaDirectorySettingTemplate | where {$_.DisplayName -eq "Group.Unified"}
   $Params = @{ templateId = $Template.Id }
   $Setting = New-MgBetaDirectorySetting -BodyParameter $Params 
   }
$params = @{
   values = @(
      @{
         name = "PrefixSuffixNamingRequirement"
         value = "GRP_[GroupName]_[Department]"
      }
      @{
         name = "CustomBlockedWordsList"
         value = "$BadWords"
      }
   )
}
Update-MgBetaDirectorySetting -DirectorySettingId $Setting.Id -BodyParameter $params

Remove the naming policy

You can use the Azure portal or Microsoft Graph PowerShell to remove a naming policy.

Remove the naming policy by using the Azure portal

On the Naming policy page, select Delete policy.
After you confirm the deletion, the naming policy is removed, including all prefix-suffix naming policies and any custom blocked words.

Remove the naming policy by using Microsoft Graph PowerShell