The control set, in firing order
- Creation gating (Entra
GroupCreationAllowedGroupId): who may create groups at all. Org-wide — also gates Outlook groups and Planner. The most common misfire: locking creation to IT and turning them into a ticket-driven bottleneck; better is a broad "trained creators" group. - Naming policy + blocked words: prefix/suffix from user attributes
(
GRP-<Department>-…). Binds every creation path including Graph. Blocked words stop "CEO" and "Payroll" teams appearing overnight. - Templates: pre-built channel/app/tab structure per work pattern (project, department, incident). Governance value: teams start organised, so archaeology never begins. Template application is async — a provisioning script must verify channels exist, not assume.
- Expiration (Entra, per selected groups): renew-on-activity or owner attestation; inactivity leads to deletion — the full 30-day soft-delete path. Point it at project-type teams; NEVER at org-wide/department teams (one missed renewal mail from a departed owner deletes a living department's team).
- Archiving: the intended end-state for finished work — read-only, searchable, restorable instantly, no clock. Archive generously; delete rarely.
The sprawl equation
Sprawl = creations − (archives + deletions) with ownership decay as the multiplier. The self-running loop: gate creation lightly → name things findably → expire project-shaped teams → archive on completion → report orphans monthly (teams with 0-1 owners) and reassign. Estates that run this loop stay navigable at 10,000 teams; estates that don't drown at 500.
What to watch (proofs)
- Creation rate: unified audit log "Added group" events per week — your sprawl input signal; a spike = some tool started provisioning.
- Naming policy proof: create a test team; the rendered name shows prefix application (and Graph-created teams get it too — verify once, trust after).
- Expiration near-misses: Entra > Groups > Expiration — groups expiring in 30 days cross-referenced with owner mail delivery; a renewal notice to a dead mailbox is a scheduled deletion.
- Orphans:
Get-Team | where { (Get-TeamUser -GroupId $_.GroupId -Role Owner).Count -le 1 }— run monthly, fix ownership before it becomes restoration. - Archive ratio: archived vs active teams trending — a healthy estate archives continuously, not annually.