# Sample Code used prevent Students from Creating Teams
# It adds the Global Admin and the SDS "All Teachers" groups as those that can create new Teams
# Andrew Sharrad 1/12/2020 v1.0

$UserName = "globaladmin@myschool.org.uk"
$Password = "Password99!"

$TeamCreate = "Stone-Allow-Team-Create"
# This group name is the default group name in STEPER.INI under [GlobalAdminTeamsCreation]

$GroupName = $TeamCreate
$AllowGroupCreation = "False"

$TeacherGroup = "All Teachers"
$StudentGroup = "All Students"


# Do not edit the lines below 


$GAPassSec = ConvertTo-SecureString -AsPlainText $Password -Force
$GACreds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $UserName,$GAPassSec


Install-Module AzureADPreview -Confirm:$False -Force -SkipPublisherCheck
Install-Module MSOnline -Confirm:$False -Force -SkipPublisherCheck
Connect-AzureAD -Credential $GACreds
Connect-MsolService -Credential $GACreds


New-MsolGroup -DisplayName $TeamCreate -Description "Group that allows the creation of Teams"
Add-MsolGroupMember -GroupObjectId (Get-MsolGroup -SearchString $TeamCreate).objectid -GroupMemberType Group -GroupMemberObjectId (Get-MsolGroup -SearchString $TeacherGroup).objectid
Add-MsolGroupMember -GroupObjectId (Get-MsolGroup -SearchString $TeamCreate).objectid -GroupMemberType User -GroupMemberObjectId (Get-MsolUser -UserPrincipalName $UserName).objectId



$settingsObjectID = (Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
if(!$settingsObjectID) {
    $template = Get-AzureADDirectorySettingTemplate | Where-object {$_.displayname -eq "group.unified"}
    $settingsCopy = $template.CreateDirectorySetting()
    New-AzureADDirectorySetting -DirectorySetting $settingsCopy
    $settingsObjectID = (Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
}

$settingsCopy = Get-AzureADDirectorySetting -Id $settingsObjectID
$settingsCopy["EnableGroupCreation"] = $AllowGroupCreation

if($GroupName) {
    $settingsCopy["GroupCreationAllowedGroupId"] = (Get-AzureADGroup -SearchString $GroupName).objectid
} else {
    $settingsCopy["GroupCreationAllowedGroupId"] = $GroupName
}

Set-AzureADDirectorySetting -Id $settingsObjectID -DirectorySetting $settingsCopy

(Get-AzureADDirectorySetting -Id $settingsObjectID).Values 
