Microsoft 365 Groups Licensing: Governance, Sprawl, and the Cost Nobody Plans For

Microsoft 365 Groups is not a separately licensed product — Groups functionality is included with every commercial M365 and Office 365 plan. But Groups are not a simple, cost-free feature either. Every M365 Group created automatically provisions a SharePoint site, a shared Exchange Online mailbox, a Planner workspace, and — if Teams is enabled — a Teams team. This means every unmanaged Group creates storage consumption, compliance scope, and administrative overhead. At scale, the governance cost of M365 Groups is real, and the storage cost of Groups sprawl in large organisations can run into thousands of pounds per year in additional SharePoint storage.

This guide explains what M365 Groups are, what resources each Group provisions, which governance features require which licence level, and how to manage Groups at enterprise scale without creating the storage and compliance liabilities that catch organisations off guard.

What Is an M365 Group?

An M365 Group is Microsoft's unified membership model for collaboration workloads. It is a shared identity object in Entra ID that binds together a set of collaborative tools provisioned as a unit. When you create an M365 Group, you simultaneously create:

A SharePoint team site: Backed by a SharePoint site collection with its own document library, consuming storage from your tenant's pooled SharePoint allocation.

A shared Exchange Online mailbox: A group mailbox for shared email, consuming Exchange Online mailbox storage (50 GB standard, expandable with archiving). This is separate from user mailbox storage.

A shared OneNote notebook: Stored in the Group's SharePoint document library.

A Planner plan: A Microsoft Planner board for task management, if Planner is enabled in your tenant.

A Teams team (if Teams-backed): When you create a Teams team, you always create an M365 Group. The Teams channels use the Group's SharePoint site for file storage.

This bundled provisioning is both a feature and a governance challenge. The feature is seamless: create a Team and everything you need is ready. The challenge is that every Group accumulates storage and compliance surface area, and most Groups are created without a plan for what happens when they are no longer needed.

Which M365 Plans Include Groups

The critical distinction is between M365 Business plans and M365 E3. Business plans do not include Entra ID P1, which means two of the most important Groups governance features — expiry policies and naming policies — are unavailable without a separate Entra P1 licence (approximately £4.50/user/month). M365 E3 includes Entra P1, so these governance controls are available at no incremental cost.

The Governance Features That Require Entra P1

Entra ID P1 (included in M365 E3) unlocks two Groups governance controls that significantly reduce sprawl and storage accumulation:

Group Expiry Policies

Expiry policies allow you to set a lifetime for M365 Groups — for example, 180 days. When a Group approaches expiry, Microsoft sends renewal notifications to the Group owners. If no owner renews the Group, it is automatically deleted (with a 30-day soft-delete recovery period). This is the single most effective tool for preventing Groups sprawl in large organisations.

Without expiry policies (i.e., in Business plans or O365 plans without Entra P1), Groups persist indefinitely regardless of whether they are active. A Teams team created for a project that ended two years ago continues consuming SharePoint storage and appearing in your admin console forever — unless an admin manually deletes it.

With expiry policies (M365 E3), orphaned Groups are automatically cleaned up, preventing the storage accumulation and administrative burden of thousands of inactive Groups. This is one of the underappreciated governance advantages of upgrading from Business Premium to E3.

Naming Policies

Naming policies allow administrators to enforce a prefix or suffix convention on Group names. For example, requiring "UK-" prefix for UK Groups, or "-Project" suffix for project-based Teams. Blocked word lists prevent users from creating Groups with prohibited terms.

Without naming policies, Groups are named arbitrarily by users — creating a tenant where you cannot quickly identify a Group's business unit, purpose, or location from its name alone. At 5,000+ Groups, this is a material governance problem for eDiscovery, audit, and security reviews.

Dynamic Group Membership (Entra P1)

Dynamic groups allow membership to be driven by user attributes (department, location, job title) rather than manual assignment. When an employee changes department, they are automatically added to the new department's Groups and removed from the old ones. This reduces licence management overhead and eliminates the orphaned membership problem that creates security exposure when employees change roles or leave the organisation.

The Storage Cost of Groups Sprawl

Every M365 Group with a Teams team or SharePoint site consumes SharePoint storage from your tenant's pooled allocation. M365 E3 includes 1 TB base + 10 GB per licensed user. A 5,000-user tenant has approximately 51 TB of pooled SharePoint storage.

At first glance, 51 TB sounds like more than enough. In practice:

A Teams team with moderate activity (50 users, 6 months of file sharing) typically accumulates 5–20 GB of SharePoint storage. A tenant with 2,000 Teams teams (common for a 5,000-user organisation without governance) has potentially 10–40 TB of Teams-related SharePoint storage. Add SharePoint Online content sites, OneDrive sync, and other SharePoint workloads, and the maths becomes uncomfortable.

Additional SharePoint storage costs £0.20/GB/month when purchased as an add-on. An organisation that accumulates 5 TB of excess storage pays £1,000/month — £12,000/year — in avoidable storage costs, all because no expiry policy was in place to clean up inactive Groups.

Compliance Implications of Groups

M365 Groups create compliance scope across multiple workloads simultaneously, which is both a feature and a governance challenge:

Retention Policies

When you create a retention policy in Microsoft Purview, you need to decide whether it applies to the Exchange Online mailbox of a Group, the SharePoint site of a Group, or both. With M365 E3, you can apply retention policies to Group mailboxes and SharePoint sites. With M365 E5 or E5 Compliance, you have access to adaptive scopes that automatically include all Groups matching specific criteria — useful when Groups are created dynamically and you need retention to apply without manual policy updates.

eDiscovery

When an eDiscovery search is run against a Group, it covers both the Exchange Online group mailbox and the SharePoint team site. This is important to understand when scoping eDiscovery holds: a hold on a Group covers both workloads. With M365 E3, Content Search and eDiscovery Standard can be used for Group content. Advanced eDiscovery (E5 or E5 Compliance) provides case management and custodian workflows. See our Advanced eDiscovery licensing guide.

Data Loss Prevention

DLP policies can be scoped to cover SharePoint sites (including Team sites backing Groups) and Exchange Online (including Group mailboxes). With M365 E3, you can apply DLP to both. The challenge is that Group-backed Teams channels also contain Teams chat messages — which are a separate workload from SharePoint file storage — and DLP coverage for Teams messages requires appropriate Teams DLP configuration in Purview.

Sensitivity Labels

M365 Groups can have sensitivity labels applied at the container level (the Group itself, not individual files). When a sensitivity label is applied to a Group, it controls SharePoint site privacy settings (public vs private), guest access, and conditional access policies for the site. This is a powerful compliance control for regulated teams. Container-level sensitivity labels require Entra P1 (included in M365 E3) and the appropriate Purview licence for the label configuration.

Groups Governance Framework: Practical Implementation

The following framework addresses the most common Groups governance failures in enterprise M365 tenants. It is implementable with M365 E3 (no additional licences required).

Step 1: Enable a Groups Expiry Policy

In Entra ID (requires Entra P1 = M365 E3+), configure a group expiry policy with a 180-day lifetime for all Groups. Set the renewal reminder to 30 days before expiry. This single action, if applied retroactively to an existing tenant, will typically identify 30–40% of Groups that have no active owner and will clean them up automatically within 6 months.

Step 2: Apply a Naming Convention

Define a naming convention that includes: department/business unit prefix (e.g., "FIN-", "HR-", "IT-"), optional project/initiative suffix (e.g., "-Proj", "-Team"), and blocked terms. Apply this as a naming policy in Entra ID. Accept that existing Groups will not conform — but all new Groups will, which gradually improves the tenant's manageability.

Step 3: Restrict Who Can Create Groups

By default, any licensed M365 user can create a Group (and therefore a Teams team or SharePoint site). Restricting Group creation to a defined set of users — team owners, department admins — significantly slows sprawl accumulation. Implement this via an Entra ID security group: only members of the "Groups Creators" security group can create new Groups. This is configurable in M365 Admin Center without requiring additional licences.

Step 4: Implement Access Reviews for Groups

Access Reviews (requiring Entra P2 = M365 E5 or Entra P2 add-on at approximately £5.20/user/month) allow you to run periodic membership reviews for M365 Groups. This is particularly important for security-sensitive Groups (finance data, HR, executive teams) where membership should be reviewed quarterly and orphaned members removed. For non-sensitive Groups, the expiry policy (step 1) is sufficient — reserve Access Reviews for your Tier 1 sensitive Groups.

Step 5: Apply Retention Policies to All Groups

In Microsoft Purview, create a retention policy that covers all M365 Group mailboxes and all SharePoint sites (which covers Group team sites). Apply your standard retention period (typically 7 years for most regulated industries). This ensures that even when a Group is deleted via the expiry policy, its content is preserved in the Preservation Hold Library for the retention period before final deletion.

Groups and the EA Renewal

Groups governance has a direct impact on your M365 EA renewal in two ways that are not always obvious:

Storage add-on prevention: Organisations with Groups sprawl frequently find themselves being asked by Microsoft to purchase additional SharePoint storage add-ons at renewal — or discovering they need them urgently. Implementing an expiry policy 12–18 months before your EA renewal allows the cleanup cycle to run and may reduce or eliminate the need for storage add-ons. Storage add-ons bundled in an EA are cheaper than post-renewal purchases, but they are cheaper still if you do not need them.

Entra P1 requirement and the Business-to-E3 decision: If you are on M365 Business Premium and your organisation is growing, the lack of Entra P1 (and therefore no expiry policies, no naming policies, no dynamic groups) is a meaningful governance cost that accumulates over time. When evaluating the Business Premium to M365 E3 upgrade, include the storage cost of unmanaged Groups sprawl in the TCO calculation. See our M365 licensing complete guide for the full upgrade decision framework.

Compliance scope reduction: Cleaning up orphaned Groups before a true-up reduces the SharePoint site count and Exchange mailbox count in your tenant, which in turn reduces the scope of any compliance-related work (DLP policy coverage, retention policy scope, eDiscovery search corpus). Smaller compliance scope translates to lower administrative overhead and reduced risk in an audit.

Groups vs Teams vs SharePoint Sites: When to Use What

One of the most effective ways to reduce unnecessary Group creation is to use SharePoint Communication Sites for read-mostly, intranet-style content instead of Teams teams or M365 Groups. Communication Sites do not create Exchange mailboxes, do not create Teams teams, and are more efficient for publishing-style use cases. Redirecting users from creating Teams teams for announcements, policies, and department intranets to Communication Sites eliminates a large proportion of unnecessary Group creation.

Frequently Asked Questions

Does M365 Groups cost extra?

No. M365 Groups functionality is included in all commercial M365 and Office 365 plans. However, advanced governance features (expiry policies, naming policies, dynamic groups) require Entra ID P1, which is included in M365 E3/E5 but not in Business plans or O365 plans.

How many M365 Groups can a tenant have?

The default tenant limit is 500,000 Groups. In practice, storage and administrative overhead become problematic long before this limit is reached. Most enterprises should implement governance controls once their Group count exceeds 500–1,000.

Can I stop users from creating Teams teams?

Yes. You can restrict M365 Group creation to a specific Entra ID security group, which prevents users from creating Teams teams (since Teams team creation always creates an M365 Group). This is the recommended approach for organisations with a sprawl problem — allow a defined set of provisioners to create Teams, rather than unrestricted self-service.

What happens to content when an M365 Group is deleted via expiry?

Deleted Groups go into a 30-day soft-delete state where they can be recovered. After 30 days, they are permanently deleted. However, if a retention policy covers the Group's SharePoint site and Exchange mailbox, the content is preserved in the Preservation Hold Library for the full retention period even after Group deletion.

Do M365 Groups affect my true-up?

Indirectly. Groups themselves are not separately licensed. However, Groups drive SharePoint storage consumption, and if your SharePoint storage allocation is exceeded, you will need to purchase additional storage at your next true-up or separately. Groups governance that controls storage accumulation therefore has a direct impact on true-up costs. See our M365 True-Up Guide for storage considerations in the true-up process.