Can users be forced to make changes in ProvisionPoint?

Title
Can users be forced to make changes in ProvisionPoint?
URL Name
Can-users-be-forced-to-make-changes-in-ProvisionPoint

Question
Yes, Owners in M365 have rights to delete, archive and manage membership.
When you provision Groups, Teams, Sites, Communities or Planners through ProvisionPoint you can define how you want to manage Ownership settings and restrict 'Owners' to be added as a Member in M365.
 
Then configure what the Owners in ProvisionPoint can do. 
Answer
We have guidance on this exact setup here:
 
To enable the following must be completed:
  1. Set 'allow everyone to create Groups' to No in Admin > Settings > Group settings.
    This will prevent user from creating Teams, Sites, etc... that are Group connected in Microsoft. It is not mandatory but does help with controlling where creations are triggered from.
    This is a tenant wide setting and will affect any M365 workspace that is group connected
  2. Limit Owner access in Microsoft to be members in Forms & Columns
    Define Owners in the request will not be given the Owner's elevated permissions in Microsoft and will have member rights instead.
  3. Manage Owner permissions via form fields in Service Definitions. 
    On each Service Definition you will set ownership to be set by custom columns
  4. Use Service Account to Group Operations in App Settings. 
    This will make the Service account the Owner of the Groups that are created. When a request is made at least one Owner must be added to Microsoft, this will be the service account.
By defining the setup above you can ensure options that the owners could do in Microsoft (Delete, Archive, manage membership, create Channels, and more) can be managed in ProvisionPoint using our actions. The Admins can choose who can delete (maybe just the Admin Group), who can archive Teams or Lock Sites (the service instance owners) and apply approval where needed.
 
Expand to limit who can create Groups in the Tenant

Group creation by default is allowed by all users, some tenants will restrict this to specific Security Groups to ensure the amount of Groups that are created.

Go to Admin > Settings > Group Settings to view the current setup of your tenant. If set to No the Group that can will be listed.

This is not mandatory to restrict actions but can help to reduce sprawl.

 

Expand to Create Custom columns for Owners & set permissions in Forms
  1. Go to Admin > Templates > Forms > Columns
  2. Create people picker columns with a name of your choice
    1. Ensure you set 'Allow selection of users' to yes
    2. If you want to allow multiple people in the field set 'Allow multiple selections' to yes
    3. If you need to restrict the people who can be selected, set a base group (Security Group)  
  3. Repeat for multiple owner and member fields. Can also add Visitor fields for the SharePoint Site.
  4. Go to Templates > Forms to group the people picker fields and any other metadata you need to collect together.
    The same form can be used on multiple Service Definitions or a form can be created for each Service Definition if there are differences.
  5. Create a new form or add columns to existing forms
    1. Ensure the people picker columns are required to ensure they are completed
    2. Define of they should be shown on the info page and if the column description should be displayed
    3. Set the Person or Group Settings for each people column, this will define which permissions are applied:
      1. Service instance owner (Owner in ProvisionPoint) Must be set to Yes
      2. Associated member (Member in M365)

        NOTE: Leaving Associated Owner as 'No' means they will not be an Owner in M365

Repeat for all columns and ensure you have the forms you need with the appropriate setup

 

Expand to set the Service Definition to manage Owners via request forms
  1. Go to Admin > Service Definitions > Request > Request Form - select the Form you have created
  2. Then go to Ownership Settings just below
    1. Set 'Manage owners and members via request form fields' to Yes
    2. Additional Default owners can be added, but these will be hidden in ProvisionPoint
    3. Save the Service Definition

New requests will respect this new setup, if you have existing workspaces in ProvisionPoint, run the Update Details action to update the fields and manually remove any owners defined in Microsoft.

 

Expand to enable the service account as the M365 Owner
  1. Go to Admin > Settings > App Settings > Service Accounts
  2. Ensure a Service account is added and that it has been authenticated
  3. Go to Settings > App Settings & Toggle 'Use service account for Group operations' to Yes

  4. Click Save
 
 
Expand to Configure the Actions in each Service Definition

For each Service Definition, enable the Actions that can be selected and the permissions.

  1. Go to Actions tab
  2. Enabled for Owners = Only Service Instance Owners will be used (not Owners in Microsoft)
  3. Named users and Groups can be added 

  4. Approval can be added and notifications enabled.

Results

Once configured all requests will default the service account as the Group Owner and limit the Owner columns you setup to be Members.
The Sites Teams ... can now be managed using ProvisionPoint Actions.
 
 
 
 
ProvisionPointSECURTIY, COMPLIANCE & GOVERNANCE