MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
An administrator wants to restrict which users in the organization can create Microsoft 365 groups. The requirement is that only members of the IT department (identified by the department attribute in Microsoft Entra ID) should be able to create groups. Which configuration should the administrator use?
⚠ Common exam trap
Candidates often confuse the 'Naming policy' (which controls group names) with the 'Group creation settings' (which controls who can create groups), or they mistakenly think that Access Reviews can enforce creation restrictions when it only reviews existing access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID > Groups > Group settings > Group creation settings.
The Microsoft Entra ID 'Group settings' blade includes a 'Group creation settings' option that allows administrators to restrict group creation to specific security groups. By configuring this setting, the administrator can limit group creation to only members of the IT department, identified by the department attribute in Microsoft Entra ID, by placing those users into a designated security group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID > Groups > Group settings > Group creation settings.
Why this is correct
This is correct because Microsoft Entra ID's Groups > Group settings > General blade contains a group creation setting that lets you restrict who can create Microsoft 365 groups. The 'Group settings' pane includes an option to restrict user ability to create groups to a specific security group. When enabled, only members of that designated security group are allowed to create new Microsoft 365 groups across Microsoft Entra ID, Teams, and other connected services. This directly addresses the requirement to restrict which users in the organization can create Microsoft 365 groups.
- ✗
Microsoft Entra ID Identity Governance > Access reviews.
Why it's wrong here
Access reviews in Microsoft Entra ID Identity Governance are designed for periodic recertification of existing group memberships, not for controlling the creation of new groups. They allow an administrator to enforce policies such as reviewing group access on a schedule and removing stale members, but they do not provide a setting to limit who is allowed to provision a new Microsoft 365 group. As a result, Access reviews have no effect on the ability to create groups.
- ✗
Microsoft Entra ID > Groups > Naming policy.
Why it's wrong here
While a naming policy in Microsoft Entra ID > Groups enforces a defined prefix, suffix, and blocked words for group names, it does not govern who has the permission to create groups. Any user with group creation rights can still create a new group as long as the proposed name complies with the naming convention. The naming policy is a naming convention control, not an authorization control, so it cannot be used to restrict group creation to specific security groups.
- ✗
Microsoft 365 admin center > Groups > Add group.
Why it's wrong here
The Microsoft 365 admin center > Groups > Add group is simply a manual interface action used by an administrator to create a single group at a time. It is not a configuration setting that can be applied to the tenant to restrict which users can create Microsoft 365 groups globally. The existence of this menu item does nothing to change the organization-wide group creation permissions, which are controlled by Microsoft Entra ID directory settings.
Go deeper
Related to this question
Learn chapter
Sensitivity Labels: Admin Configuration
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Security group
A security group is a virtual firewall that controls inbound and outbound traffic to AWS resources, such as EC2 instances, based on defined rules.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.