Anyone who has run a Microsoft 365 tenant for more than a year has seen it happen. Teams multiply, groups pile up, and eventually you're looking at a long list of abandoned workspaces, forgotten project sites and groups without an owner. In many tenants there is no process for cleaning this up, and sometimes nobody even notices the mess. This is the problem the Microsoft 365 groups expiration policy and the naming restrictions are meant to solve. If you want security, compliance and the user experience to stay under control, set these policies up before group sprawl gets out of hand.

Active groups renew themselves and owners get warned before expiry

Group lifecycle management lives in the Microsoft Entra admin center under Groups → Expiration. This is where you set the default lifetime for new Microsoft 365 groups: 180 days, 365 days or a custom value. You need at least Entra ID P1 for it. What I like most is that a group still in use (file activity, Teams chats, SharePoint edits) gets its expiration extended automatically. Activity is tracked across the tenant, so active groups don't get deleted by mistake. As the expiration date gets closer, owners receive email notifications and can renew manually if they need more time.

Practical tip: Owners often miss or ignore the expiration emails, especially when they have changed roles or are no longer active. Require at least two owners per group and audit ownership regularly so you don't end up with orphaned resources.

Once a group expires, soft delete takes over. The group is kept for 30 days, and during that time you can restore it from the Entra admin center or with PowerShell. After that it is permanently deleted, and all associated resources are gone for good.

A naming policy enforces prefixes, suffixes and blocked words

Large organizations need clear naming standards. I regularly see groups with cryptic or inappropriate names, and occasionally names that give away sensitive information. The naming policy in Entra ID (Groups → Naming policy) lets you define mandatory prefixes (such as "DE-" or "PROJ-"), suffixes (such as "-Team") and a list of blocked words. It applies to all new groups, but existing groups are not renamed retroactively. Setting it up is simple enough, though you should watch the syntax and a few edge cases (the official documentation on the naming policy covers them).

PowerShell limits group creation to a chosen security group

One request comes up in almost every governance project: customers want to stop everyone from creating new groups, and with them new Teams, SharePoint sites and Planner plans. As of May 2025 there is still no button for this in the admin center. You have to configure the "Group.Unified" directory setting through Microsoft Graph PowerShell and restrict group creation to a specific security group (for example "M365-Group-Creators"). In my experience this is one of the most effective ways to rein in Teams sprawl (I go into the practical effects in my post on Teams governance and sprawl). It requires Entra ID P1 and the following steps:

# Prerequisites: PowerShell 7, Microsoft.Graph module, Entra ID P1
Connect-MgGraph -Scopes Directory.ReadWrite.All
$group = Get-MgGroup -Filter "displayName eq 'M365-Group-Creators'"
$template = Get-MgDirectorySettingTemplate | Where-Object {$_.DisplayName -eq "Group.Unified"}
$setting = $template.CreateDirectorySetting()
$setting["EnableGroupCreation"] = $false
$setting["GroupCreationAllowedGroupId"] = $group.Id
New-MgDirectorySetting -DirectorySetting $setting

Soft delete and ownerless group alerts close the remaining gaps

Expiration and naming aside, ownerless groups are an easy risk to overlook. When all owners are removed or go inactive, notifications can go to backup users you choose, who can then take over ownership. You configure this under the group options in the Entra admin center. If you restore a group within the 30-day window, its resources come back with it, including the mailbox, SharePoint, Teams and Planner (as long as it hasn't been permanently deleted). The Microsoft documentation on group lifecycle has the details.

The flow is easier to follow as a diagram. It runs from creation through active use to expiration, soft delete and a possible restore, with the owner notifications along the way:

flowchart TD
  A["Group created"] --> B["Active use"]
  B --> C["Expiration date reached?"]
  C -- "No" --> B
  C -- "Yes" --> D["Owner notified"]
  D --> E["Group renewed?"]
  E -- "Yes" --> B
  E -- "No" --> F["Soft deleted (30 days)"]
  F --> G["Restore possible"]
  G --> B
  F --> H["Permanently deleted after 30 days"]

Figure: Lifecycle of a Microsoft 365 group with expiration, soft delete, and restore.

Lifecycle discipline pays off in my experience

Putting expiration, naming and creation controls together is one of the best things you can do to keep Microsoft 365 manageable and secure. Setting an expiration period once and forgetting about it isn't enough, though. Review group ownership on a regular basis, look at the reports, and adjust your processes as the organization changes (see Microsoft's guidance to manage who can create groups). If you're rolling out Microsoft 365 Copilot or other AI tools, weak group governance will quickly turn into oversharing or compliance problems. Time spent on a proper lifecycle strategy now saves you trouble later with your data, access rights and compliance posture.