Naming Policy

Enforce consistent group naming across the organization with prefixes, suffixes, and blocked words. Naming policies help maintain discoverability and governance standards for all Microsoft 365 Groups.

Warning: Group naming policies require Azure AD Premium P1 licenses for users who create groups. Naming policies are not enforced for global administrators.

Prefix/Suffix Configuration

Configure naming templates using static strings or dynamic Azure AD attributes:

Prefix Options

Static string prefix (e.g., GRP_)
Azure AD attribute prefix (e.g., [Department], [Company])

Suffix Options

Static string suffix (e.g., _Team)
Azure AD attribute suffix (e.g., [CountryOrRegion], [Office])

Preview Example

With prefix GRP_ and suffix _[CountryOrRegion]:

User in Marketing from the US creates “Project Alpha”
Result: GRP_Marketing_US

Supported Attributes

Attribute	Example Value	Description
`[Department]`	Marketing	User’s department from Azure AD
`[Company]`	Contoso	User’s company attribute
`[Office]`	Seattle	User’s office location
`[CountryOrRegion]`	US	User’s country or region code
`[Title]`	Manager	User’s job title

Blocked Words

Prevent specific words from being used in group names. Matching is case-insensitive.

Example blocked words:

CEO
Payroll
HR
Salary
Confidential

Blocked words prevent users from creating groups with names containing these terms. Admins can override this restriction.

Classification and Sensitivity

Naming policies work alongside classification labels for comprehensive governance:

Classification	Description	Applied Policies
Public	Non-sensitive content, open collaboration	Guest access allowed, external sharing enabled
Internal	Internal business content, limited external sharing	Guest access restricted, internal sharing only
Confidential	Sensitive business data, strict access controls	No guests, encryption required, audit logging
Highly Confidential	Most sensitive data, regulatory compliance	Maximum restrictions, DLP policies, watermarking

Note: Microsoft 365 sensitivity labels provide more granular control than classic classifications. Sensitivity labels can apply encryption, content marking, access restrictions, and DLP policies automatically. Configure sensitivity labels in the Microsoft Purview compliance portal.

Group Creation Settings

Control who can create Microsoft 365 Groups in the tenant:

Allow all users to create groups — Any licensed user can create M365 Groups (default)
Restrict to security group — Only members of a specified security group can create groups

Creation Sources Affected

Restricting group creation affects all these Microsoft 365 services:

Microsoft Teams
Outlook Groups
SharePoint
Planner
Yammer
Power BI

Usage Guidelines

Define usage guidelines that are shown to users when they create new groups:

When to create a group vs. use an existing one
Naming conventions and required information
Classification requirements for sensitive data
Guest access policies and approval process
Ownership responsibilities and handoff procedures
Data retention and archival expectations

Cross-Tenant Deployment

OpsPilot365 enables bulk configuration of naming policies across multiple managed tenants:

Define Policy — Create group settings template with naming rules
Select Tenants — Choose target tenants by tag or manual selection
Preview — Review changes and conflicts before applying
Deploy — Apply with rollback option

Best Practices

Governance

Restrict group creation to trained users
Enforce naming policies for discoverability
Set appropriate expiration periods
Require classifications for all groups
Document owner responsibilities clearly

Security

Review guest access policies quarterly
Use sensitivity labels for sensitive data
Monitor orphaned groups regularly
Audit group membership changes
Implement conditional access for groups

API Reference


# Get group settings (directory settings)
GET /groupSettings


# Configure naming policy
PATCH /groupSettings/{setting-id}
{
  "values": [
    {
      "name": "PrefixSuffixNamingRequirement",
      "value": "GRP_[GroupName]_[Department]"
    },
    {
      "name": "CustomBlockedWordsList",
      "value": "CEO,Payroll,HR"
    }
  ]
}


# OpsPilot365 API - Bulk group settings deployment
POST /api/groups/settings/deploy
{
  "tenantIds": ["tenant-1", "tenant-2"],
  "settings": {
    "enableGroupCreation": false,
    "groupCreationAllowedGroupId": "creators-group-guid",
    "namingPolicy": "GRP_[GroupName]_[Department]",
    "blockedWords": "CEO,Payroll,HR,Salary"
  }
}

GET /api/m365-groups/naming-policy — Get naming policy
PUT /api/m365-groups/naming-policy — Update naming policy