Quick way to do this is with PowerShell:

#Connect to Office365
Import-Module MSOnline
Connect-MsolService
$O365Cred = Get-Credential
$O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection
Import-PSSession $O365Session

#Check if the user has an Alternate Email Address (Recovery Address)
Get-MsolUser -UserPrincipalName [email protected] | select -ExpandProperty AlternateEmailaddresses

#Check if the user has an Alternate Email Address (Recovery Address)
Set-MsolUser -UserPrincipalName [email protected] -AlternateEmailAddresses [email protected]

If this setting is unset for an administrator, Office365 gives you a nice reminder about adding an alternate email address in case your primary account gets locked out.

You can add this information when first setting up the account:

It can also be added for an existing admin user by going to the Gear, Office 365 settings, and edit your settings in the ‘me†section, you can enter your mobile phone number and alternate email there.

In simple terms Room List work  as distribution groups for conference or other types of rooms.

Use PowerShell to login to Office365:

#Connect to Office365
Import-Module MSOnline
$O365Cred = Get-Credential
$O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection
Import-PSSession $O365Session

Create a room list:

New-DistributionGroup -Name HQ -DisplayName "HQ" –PrimarySmtpAddress [email protected] –RoomList

Add rooms to a list:

Add-DistributionGroupMember –Identity "HQ" -Member [email protected]

Check what Room Lists you have:

Get-DistributionGroup | Where {$_.RecipientTypeDetails -eq "RoomList"} | Format-Table DisplayName,Identity,PrimarySmtpAddress

Check what conference rooms are part of a particular room list:

Get-DistributionGroupMember –Identity "HQ"

Why is it important to control Office 365 Group creation?

This feature is enabled by default. So its better to put restrictions in place or later clean up sites, groups, permissions set by organization users.

Which Group?

SharePoint frequently reuses terms, which often makes conversations and forum posts a lot of fun. Thereâ€s at least three “Groups” in Office 365:

• Active Directory Groups: Groups at the AD level. Outside of SharePoint. Useable across all site collections, and other applications. A “Sales Managers” AD group can be created once, updated in one place and used across all site collections in the tenant.
• SharePoint Groups: Collections of users (people) and AD groups. Scoped to a single site collection. A “Sales Managers” SharePoint group would need to be created in each of the site collections and all updates repeated across all of the site collections.
• Office 365 Groups: A new collaboration option! A combination of a mailbox and a site collection. Not a group useable for managing access to SharePoint sites.

Office 365 Groups

Office 365 Groups are a combination of an Exchange email account with the groupâ€s name that is used to store conversations, and a “OneDrive – like” site collection to store files.

A collection of Office 365 Groups facts:

• Internally, to distinguish traditional groups from the new Office 365 Groups, Groups are called “Unified Groups”. Externally they should be called “Office 365 Groups”, not “SharePoint Groups”.
• Creating a Group creates an AD Distribution group, an email address and a “hidden” SharePoint Site Collection. The site collection is not visible in the tenant admin pages. The AD group is not manageable from Azure AD, only from the tenant admin Groups pages. (You can see members in Azure AD, but cannot edit them.)
• Groups can be created from:
  • Outlook (OWA).
  • A userâ€s OneDrive.
  • The “GROUPS” page in the tenant Admin site. Here you can create both “Office 365 Groups” and “security groups”.
• Conversations are stored in Exchange inboxes and files are stored in SharePoint Site Collections.
• Groups are defined and managed in Azure AD. (Which explains why the PowerShell cmdlets for Groups are not in the SharePoint Online cmdlet library.)
• Each user may create up to 250 Groups and can be a member of up to 1,024 Groups. Thereâ€s no limit for number of Groups per tenant.
• Emails can be sent in the name of the group by members. (Requires a PowerShell based change.)
• Groups will not be deleted if the Groupâ€s owner is deleted.
• Groups use a OneDrive for Business site under the covers. (Template: GROUP#0)
• URL for the files site collection looks like a normal team site instead of a OneDrive site:  https://yourdomain/sites/groupsitename
• If there is a URL conflict, a number is appended to the name: https://yourdomain/sites/groupsitename51
• URL for the mailbox is “guessable”: https://outlook.office365.com/owa/#path=/group/yourGroupName@yourDomain.onmicrosoft.com/people
• Groups site collections are not (currently) displayed in the admin Site Collections page. You may discover their existence when you create a new site collection that has the same name as a group site. “The site collection already exists. Please enter a different address.”
• PowerShell:
  • Get-SPOSite does not return Groups site collections, but you can access a Groups site by URL.
  • Get-SPOUser does not return users for Groups sites.
• Groups file storage is counted against the tenant quota. Itâ€s not considered to be a personal OneDrive. There is no “user” for the Group OneDrive. The mailbox can store up to 50GB of messages, posts and calendar entries. The SharePoint Site Collection has a max of 1TB.
• Search: There is a search box, but it opens the Search Center in a new window/tab and searches all of SharePoint, not just the Groups file site.
• The document library in the Group site is very much like a OneDrive for Business library. No ribbon, no custom columns, no metadata and no Content Types. The Groups library is very limited:
  • Only one library, and itâ€s not customizable.
  • Canâ€t check out/in. (I saw this listed as a feature, but itâ€s not in my tenants.)
  • Versioning is enabled (Major only)
  • Cannot add/delete columns (i.e. use any custom metadata that might be useful to search or eDiscovery.)
  • Cannot use workflows.
  • Cannot audit security from the browser.
  • No branding. Cannot be opened by SharePoint Designer.
• The Site Collection is VERY limited.
  • Almost all of the links for site or list maintenance are redirected to the home page.
  • There is no Settings page.
  • There is no Site Permissions page, so thereâ€s no Site Permissions page or 2nd tier recycle bin.
  • You cannot create new lists or libraries.
• Library Sync: The Sync button works with the new OneDrive for Business sync client. So, keep in mind that group members of easily offline all of the content.
• Recycle Bin:
  • There is a recycle bin, but you can only access the user level.
  • If you share a file with a non-member with “Edit”, they can delete the file, but get “Sorry, you don’t have access to this page” when they click the Recycle Bin link.
  • There is no Site Collection recycle bin page available. The Groups “owner” canâ€t recover files deleted by members.
• Can be administered and reported on from PowerShell as part of the Exchange Online cmdlets.
  https://technet.microsoft.com/en-us/library/jj200780(v=exchg.160).aspx
  cmdlets: Get/Set/New/Remove-UnifedGroup and Get/Add/Remove-UnifiedGroupLinks
  https://support.office.com/en-us/article/Use-PowerShell-to-manage-Office-365-Groups-aeb669aa-1770-4537-9de2-a82ac11b0540
• Groups can be disabled for all users. (PowerShell)
• Groups can be disabled for a subset of users. (Requires PowerShell.)
• Security:
  • New groups default to “Public”. Everyone has access. You must remember to choose Private when you create the group.
  • I canâ€t find a place to change Public/Private status after the group has been created.
  • The names of groups are not private. They will be seen in “Send to”, “Share” and other places where user names can be seen. All groups, public and private, are listed in the “Browse Groups” screens. (Train your users not to use group names that reveal confidential data. You know, names like “IT Layoff Planning Group”. )
  • Files can be shared with the “group”. They will be listed in the “Shared with us” tab.
  • Files that are shared with the “group” will be visible to all users even for Private groups! (I think this is a bug!) (The user must know the URL to the Files site.)
  • Files can be “reshared”. Sam has a site named “My Private Group”, which is Private, He shares a file with Robert (with Edit or View). Robert can only see that one file in the group site. Robert shares with Susan. Susan can then share with………
  • Users who guess the URL to the file site can see the site, but no files, or only files shared with them. They can see the list of “members” and who the owner is.

Groups vs. Team Sites

Cleaning up the mess

So since this feature is enabled by default. Users in your organization may have already started creating groups and hidden SharePoint site.

So first we need to disable this option right away.

Prerequisites:

• The 64-bit version of the Microsoft Online Services Sign-in Assistant: Microsoft Online Services Sign-in Assistant for IT Professionals RTW.
• The 64-bit version of the Windows Azure Active Directory Module for Windows PowerShell Preview.[su_note note_color=”#fafae8″]IMPORTANT: Make sure that you install version 1.1.130.0 of Microsoft Azure Active Directory Module for Windows PowerShell Preview so that you have the functionality to run the required cmdlets. Note that this is the Preview version.[/su_note]

Check your Company-level configuration settings

Now need to check your company-wide configuration settings through the Get-MsolCompanyInfo Windows PowerShell cmdlet. This cmdlet will display your current company-wide configuration settings that affect all users. You specifically need to verify that the UserPermissionToCreateGroupsEnabled parameter is set to False.

To check your Company-level configuration settings

You will first need to connect to your Office 365 service. In the Windows Azure Active Directory Module for Windows PowerShell, type and enter the following:

Connect-MsolService

In the Sign in to your Account screen, enter your credentials to connect you to your service, and click Sign in.

You will be returned to a prompt in the Windows Azure Active Directory Module.

You will need to display your company-wide configuration settings. To do this, type and enter:

Get-MsolCompanyInformation

This will display a listing of the current configuration settings that apply to all users in your company.

As you can see the value for the UsersPermissiontoCreateGroupsEnabled setting is True. We need to change this to False.

To change the UsersPermissionToCreateGroupsEnabled setting value

You will first need to use the Set-MsolCompanySettings cmdlet to change the UsersPermissionToCreateGroupsEnabled parameter to False. In the Windows Azure Active Directory Module for Windows PowerShell, type and enter the following:

Set-MsolCompanySettings - UsersPermissionToCreateGroupsEnabled $False

You will be returned to a prompt in the Windows Azure Active Directory Module.

After changing the setting, you then need to run the Get-MsolCompanyInfo cmdlet to verify that the value has changed to True.

Get-MsolCompanyInfo

After running the cmdlet, check the displayed information to verify that the UsersPermissionToCreateGroupsEnabled setting value has changed to False.

Identifying the site collections in PowerShell

Connect to SharePoint

#Connecting to SharePoint

#User account with Global Admin Permissions
$adminUPN="[email protected]"

#Organization Name (myorganizationinc.onmicrosoft.com)
$orgName="myorganizationinc"

#Prompting and using the password
$userCredential = Get-Credential -UserName $adminUPN -Message "Type the password."

#Making the Connection
Connect-SPOService -Url https://$orgName-admin.sharepoint.com -Credential $userCredential

Get a list of Site Collections

Get-SPOSite -Detailed | Format-Table -AutoSize

More than likely the Group SharePoint Site is restricted to the user that may have created it. You may get this error when trying to remove it:

To remove it you need to take ownership as the CollectionOwner

Set-SPOUser -Site http://myorganizationinc.sharepoint.com/sites/<YourGroupsSite> -LoginName [email protected] -IsSiteCollectionOwner $true

Now if you want to do this for all the site collections:

$Sites = Get-SPOSite
ForEach ($Site in $Sites)
{
Set-SPOUser -Site $site -LoginName [email protected] -IsSiteCollectionOwner $true
}

Once this is applied the admin will be able to remove the hidden Sharepoint collection. Remove the site collections that are no longer needed.

Remove-SPOSite -Identity https://myorganizationinc.sharepoint.com/sites/<YourGroupsSite> -NoWait

Deleting the Groups

Now to delete the groups that the users created. Head over to the Office365 Admin Portal.

Click the “Office 365 group” from the selection to show all groups (These should be all cloud based)

Once the groups are displayed remove them as necessary.

Groups are no longer in your environment.

Planning for the future: Migration of Distribution Groups to Groups

If you are in Hybrid mode you cannot user Groups in a clean fashion. It will get messy. Sooner or later you will need to plan for migration of your distribution groups to Groups. Know your current limitations and hold.

Migrate distribution lists to Office 365 Groups – Admin help

Distribution list eligibility for migration

The following table lists which distribution lists are eligible or not eligible for migration

Password Never Expires is bad security practice, but there are situations that might require it.

I had a similar request on how this could be done.

Setting it for multiple users:

#Connect of Office365
Import-Module MSOnline
$O365Cred = Get-Credential
$O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection
Import-PSSession $O365Session
Connect-MsolService –Credential $O365Cred 

#Get a List of user that belong to the second domain
$SDusers = Get-MsolUser -All -DomainName "yourseconddomain.com"

#Setting the password never to expire
ForEach($SDuser in $SDusers)
{
    Set-MsolUser -UserPrincipalName $SDuser -PasswordNeverExpires $true
}

Setting it for a single user:

Get-MSOLUser -UserPrincipalName [email protected] | Select PasswordNeverExpires

In my case to check which users are covered and meeting policy and get the users addressed.

Get-MsolUser -All -DomainName "yourdomainname.com" | select DisplayName, LastPasswordChangeTimeStamp,@{Name=”PasswordAge”;Expression={(Get-Date)-$_.LastPasswordChangeTimeStamp}}

The output will be similar to:

Updating the global address list requires to have the Address List Management role. By default, nobody has this role.

1. Assign the AddressList Management role

• Login with your administrator account to the Office 365 portal.
• Go to Exchange Admin center, Permissions and admin roles.
• Create a new role group and assign the AddressList role.

2. Update the AddressList

Once you have the AddressList role assigned, you can use the powershell commands to update the address list. You will have to wait for sometime until the new cmdlets are available.

• First thing, logon to Exchange online using PowerShell.

• $UserCredential = Get-Credential
  $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
  Import-PSSession $Session

• Run the command Get-AddressList and verify that itâ€s working. (This may take some to work after creating the role)
• RunSet-AddressList -Identity “All users”
• Your address book is now updated

Anyways, for someone who may come across this weird issue, here is the fix for it.

Set-Mailbox [email protected] -Type Regular

This will convert it from a shared mailbox, or a resource mailbox to a user mailbox.

I like to make resource booking days 1 year from the day of making the reservation/ appointment. Now instead of visiting each calendar and making the change, powershell can help us out.

#Connect to Office365 
$cred = Get-Credential
Import-Module MSOnline
Connect-MsolService -Credential $cred
$s = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $cred -Authentication Basic -AllowRedirection
$importresults = Import-PSSession $s

#Get all the Rooms and make the booking days to 365
Get-MailBox | Where {$_.ResourceType -eq "Room"} | Set-CalendarProcessing -BookingWindowInDays 365

Happy Booking!

These commands disable group creation for OWA and Outlook only. If you want to disable the group creation in your organization, use Azure Active directory settings. Check out Windows PowerShell for more details.

To disable Group creation for all users

1. Start Windows PowerShell.
2. At the prompt, type:

   Set-OwaMailboxPolicy -Identity yourdomainname.com\OwaMailboxPolicy-Default -GroupCreationEnabled $false

To disable a policy for a subset of users

1. Start Windows PowerShell.
2. Create a new mailbox policy by typing this command, replacing <policy name> with your policy. (If you already have an OWA mailbox policy, skip to the next step.)

   New-OwaMailboxPolicy –Name “<policy name>”

3. set the GroupCreationEnabled value to false, replacing <policy name> with the name of your policy.

   Set-OwaMailboxPolicy –Identity “<policy name>” –GroupCreationEnabled $false

4. Set the policy on the mailboxes of the user who isnâ€t allowed to create Groups. Replace <user> with the name of the user.

   Set-CASMailbox –Identity <user> -OWAMailboxPolicy “<policy name>”

Sometimes admin forget to remove the license for the shared box after conversion and there is no GUI alternative to see if the shared mailbox is licensed. Shared mailbox in Office365 do not require a license.

To find out what shared mailboxes are “accidentally” licensed:

#Connect to Office365
Import-Module MSOnline
$O365Cred = Get-Credential
$O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection
Import-PSSession $O365Session

#To view summary information about your current licensing plans and the available licenses for each plan
Get-MsolAccountSku

#Find out shared mailboxes that are licensed
Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails SharedMailbox | Get-MsolUser | Where-Object { $_.isLicensed -eq "TRUE" }

#Find out shared mailboxes that are licensed and remove them
#You need to supply your licensing plan name to remove licenses
Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails SharedMailbox | Get-MsolUser | Where-Object { $_.isLicensed -eq "TRUE" } | foreach {Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -RemoveLicenses "yourlicenseplan:ENTERPRISEPACK"}