Site Creation Is Blocked for Licensed Users: Root Cause and Fix

You are a SharePoint administrator and a user with a valid SharePoint license reports they cannot create a new site. The New button is grayed out, or clicking Site creation returns a permission error. This problem occurs because SharePoint site creation privileges are controlled by a separate security group policy, not by the user license alone. This article explains the exact group policy that blocks site creation and provides the fix to restore creation rights for licensed users.

Why Site Creation Is Blocked Despite a Valid License

SharePoint site creation is governed by two layers: the user license and the SharePoint admin settings. A user license grants the right to use SharePoint Online. But the ability to create sites is a separate permission controlled by the SharePoint admin. The root cause is almost always the tenant-level site creation setting. When this setting is changed to Only admins, all non-admin licensed users lose the ability to create sites. A second cause is a site creation policy applied to a specific site collection that blocks users from creating subsites or team sites under that site. A third cause is a custom permission level that removes the Create Sites permission from the user. These settings are independent of the user license and can block creation even when the license is active.

The Tenant-Level Site Creation Setting

The SharePoint admin center has a global toggle under Settings > Site creation. This toggle has two options: Users can create sites and Only admins can create sites. When set to Only admins, every licensed user who is not a SharePoint admin or site collection admin cannot create a site. This setting applies to all site types: team sites, communication sites, and subsites. It is the most common reason site creation is blocked.

Site Creation Policies Applied to Specific Sites

A site creation policy can be applied to a specific site collection through the SharePoint admin center. This policy can deny site creation for that site collection even if the tenant-level setting allows users to create sites. The policy is set under Active sites > select a site > Policies > Site creation. If the policy is set to Block site creation, users cannot create subsites or team sites under that site collection.

Custom Permission Levels Removing Create Sites

A custom permission level can remove the Create Sites permission from a user or group. This permission is required to create subsites. If the user is assigned a permission level that does not include Create Sites, they cannot create subsites even if they have full control over the parent site. This is less common but can occur when administrators create custom permission levels for security reasons.

Steps to Fix Site Creation for Licensed Users

Follow these steps in order. After each step, ask the affected user to try creating a site again. Stop when the issue is resolved.

1. Check the tenant-level site creation setting in the SharePoint admin center
   Sign in to Microsoft 365 admin center as a SharePoint admin. Go to Admin centers > SharePoint. In the SharePoint admin center, select Settings. Under Site creation, look at the option selected. If it says Only admins can create sites, change it to Users can create sites. Select Save.
2. Verify the user is not blocked by a site creation policy
   In the SharePoint admin center, select Active sites. Find the site where the user is trying to create a subsite or team site. Select the site, then select Policies. Under Site creation, check if Block site creation is selected. If it is, select Allow site creation and select Save.
3. Check the user permission level for the Create Sites permission
   Navigate to the site where the user needs to create a subsite. Select Settings (gear icon) > Site permissions. Select Advanced permissions settings. On the ribbon, select Permission Levels. Find the permission level assigned to the user. Select the permission level name. Scroll to Site Permissions and verify Create Subsites is checked. If it is not checked, select it and select Save. If the permission level is custom and cannot be edited, assign the user a different permission level that includes Create Subsites.
4. Use PowerShell to check the DenyAndAddCustomizePages setting
   Open SharePoint Online Management Shell as an administrator. Run Connect-SPOService -Url https://[tenant]-admin.sharepoint.com. Replace [tenant] with your tenant name. Run Get-SPOSite -Identity https://[tenant].sharepoint.com/sites/[sitename] | fl DenyAndAddCustomizePages. If the value is Blocked, run Set-SPOSite -Identity https://[tenant].sharepoint.com/sites/[sitename] -DenyAndAddCustomizePages Disabled. This setting blocks site creation when set to Blocked.

If Site Creation Still Has Issues After the Main Fix

“You don’t have permission to create sites” error message appears

This error can appear even after the tenant setting is changed. The user may be in a group that has a deny permission on the site collection. Check the site collection permissions for any deny entries. Go to Site permissions > Advanced permissions settings. Select Check Permissions. Enter the user name and select Check Now. If the effective permission shows Deny for Create Subsites, remove the deny entry from the group or user.

Site creation button is grayed out for communication sites

Communication sites can only be created by users who have a SharePoint admin role or a site collection admin role. The tenant-level setting Users can create sites does not apply to communication sites. To allow a licensed user to create a communication site, assign them the SharePoint admin role in Microsoft 365 admin center. Go to Users > Active users. Select the user, select Manage roles, select SharePoint admin, and select Save changes. After this, the user can create communication sites.

User can create sites but cannot create subsites

This is usually a permission level issue. The user may have Edit or Contribute permission on the parent site, which does not include the Create Subsites permission. Change the user permission level to Full Control or create a custom permission level that includes Create Subsites. Go to Site settings > Site permissions > Advanced permissions settings. Select the user, select Edit User Permissions, and select Full Control. Select OK.

Setting	Location	Effect on Site Creation
Tenant-level site creation	SharePoint admin center > Settings > Site creation	Blocks all non-admin users when set to Only admins
Site creation policy	Active sites > select site > Policies > Site creation	Blocks creation on that specific site collection
Permission level	Site settings > Site permissions > Permission levels	Blocks subsite creation when Create Subsites is missing
DenyAndAddCustomizePages	PowerShell Get-SPOSite / Set-SPOSite	Blocks site creation when set to Blocked

Now you know how to identify and fix the three main causes of blocked site creation for licensed users. Start with the tenant-level setting in the SharePoint admin center, then check the site creation policy, and finally verify the user permission level. For advanced control, use the DenyAndAddCustomizePages PowerShell cmdlet to manage site creation at the site collection level.