Microsoft Planner privacy settings: how to set them

Planner plans use Microsoft 365 Groups for identity and membership. That means a plan’s privacy (Public or Private) is the same as the underlying Group’s visibility: change the Group and you change who can discover and see the plan. This article gives exact steps to make a plan private (or public), how guest and file sharing affect access, tenant controls that enforce privacy, and how to audit who can see a plan.

What exactly does Planner privacy control and how it relates to the Microsoft 365 Group

• You need: an Office 365 account with access to the Planner plan, Group owner rights to change Group visibility (or an admin account), and, for tenant-level work, admin credentials for Azure AD, Microsoft 365 admin center, SharePoint admin center or PowerShell.

Planner plans live on Microsoft 365 Groups. The Group defines membership, owners, guests, and visibility. Planner shows plan boards and tasks based on those Group memberships; Planner does not keep a separate privacy flag.

If the Group is Public: any authenticated user in the tenant can discover the Group and view its membership and the Planner content (tasks, checklists, attachments) unless attachments are further restricted on SharePoint/OneDrive. Public often means the Group is discoverable in the Outlook Groups gallery and users can join or request to join depending on tenant settings.

If the Group is Private: only members and owners can view tasks, buckets, task comments and attachments. Guests explicitly added to the Group have access according to guest policies.

What visibility affects directly:

• Discoverability in the Outlook Groups gallery and address book.
• Who can open the Planner plan and view tasks.
• Who can add tasks or attachments (members and owners).

What visibility does not automatically control:

• External sharing of individual files stored in the Group’s SharePoint site or OneDrive links — those follow SharePoint/OneDrive sharing controls.
• Teams channel-level posts if the Group is connected to a Team; Teams guest settings and channel permissions also matter.

Can I change a plan from Public to Private and vice versa — here’s how

Prerequisites

• You are a Group owner or a tenant admin (Global Admin or Groups admin) when changing Group visibility.
• You understand that changing visibility affects discoverability and membership workflows.

Steps to change visibility from the Planner UI (when the control is available)

1. Open the plan in Planner.
2. Click the plan name to open plan details or select the three-dot menu and choose "Plan settings".
3. If "Privacy" or "Group settings" appears, choose Public or Private and save.

Changing a Group from Private to Public can expose plan content to all tenant users immediately.

If the Planner UI does not show a visibility control, use Outlook on the web

1. Open Outlook on the web (outlook.office.com) and go to Groups in the left nav.
2. Select the Group that backs the plan.
3. Click the Group name or the settings gear for the Group to open Group settings.
4. Under "Privacy" choose Public or Private and save.

If Group settings prevent changing visibility use the Microsoft 365 admin center

1. Sign in to admin.microsoft.com with Global Admin or Groups admin rights.
2. Go to Teams & groups > Active teams & groups.
3. Find and select the Group, then Edit settings > Privacy and change to Public or Private and save.

PowerShell (when UI changes are blocked)

1. Connect to Azure AD or Exchange Online depending on which cmdlets you will use.

Connect-AzureAD
Set-AzureADGroup -ObjectId <GroupObjectId> -Visibility Private

2. Replace <GroupObjectId> with the Group’s objectId. Some tenants use Exchange Online cmdlets instead; check which module is available in your environment.

Expected result: after you change the Group privacy, the Planner plan reflects the new visibility immediately. If users still see old behavior, allow a few minutes for directory caches to update.

Completion You know the change worked when non-members can no longer open the plan after it was set to Private, or when users across the tenant can discover and open it after it was set to Public. For full verification, see the audit steps in the "How to verify who can see a plan and audit access" section.

How guests, external sharing, and attachments affect privacy — what to watch for

Adding a guest account to the Group gives that guest the same access to the plan as internal members. Files attached to tasks are stored in the Group’s SharePoint site (or in the uploader’s OneDrive if attached that way) and follow SharePoint/OneDrive sharing rules.

Common exposure scenarios and how to avoid them:

• Scenario: Someone pastes a SharePoint file link into a task comment and sets that file’s sharing link to Anyone with the link. Result: external parties with the link can open the file even if the Group is Private. Avoid by using internal-only links when you want privacy.
• Scenario: A guest in another organization is added as a Group member to help on a task. Result: the guest sees all plan tasks and attachments. Avoid by adding guests only when necessary and reviewing guest permissions.
• Scenario: The Group is connected to a Team; a user posts a file in a public channel. Result: Team channel and Planner visibility depend on both the Group and Team channel settings. Avoid posting sensitive files in channels tied to broadly visible Groups.

Practical controls to reduce accidental exposure:

• When attaching files, choose the file stored in the Group site and confirm its sharing link is set to internal only.
• Use SharePoint site settings to restrict external sharing for that site.
• Restrict guest invites through Azure AD if you don’t want external members added casually.

Tenant-level controls admins should set to enforce Planner privacy rules

Several tenant settings affect Planner and Group privacy. Admins should configure these controls where appropriate.

Key admin controls and where to set them:

• Azure AD B2B guest invite and collaboration settings: controls whether guests can be invited and what they can do. Configure in Azure AD > External Identities > External collaboration settings.
• Office 365 Groups creation and management restrictions: limit who can create Groups to prevent uncontrolled public Groups. Configure by using a security group to restrict creation in Azure AD or via PowerShell.
• SharePoint external sharing: controls sharing links and site-level external access. Configure in the SharePoint admin center under Policies > Sharing.
• Teams guest access and external access: configure in Teams admin center > Org-wide settings > External access and > Guest access.
• Sensitivity labels and site privacy: Sensitivity labels applied to a Group/site can enforce encryption, external sharing restrictions, or default privacy. Configure in Microsoft Purview compliance center > Information protection > Labels and publish them to Groups and SharePoint.

Where PowerShell helps

# Restrict Group creation to a security group
Install-Module AzureAD
Connect-AzureAD
Set-AzureADDirectorySetting -Id <SettingId> -DirectorySetting @{ "EnableGroupCreation" = $false }

exact cmdlets and parameters vary between modules (AzureAD, AzureADPreview, Microsoft.Graph). Consult your tenant’s available modules before running commands.

Review these tenant settings together: restricting guest invites without adjusting SharePoint will still leave file-level links vulnerable. Sensitivity labels provide an additional block where applied.

How to verify who can see a plan and audit access

You can verify access by checking Group membership, confirming guest accounts, testing access from outside, and searching audit logs.

Checks to run

• View Group membership in Outlook on the web or the Microsoft 365 admin center to see owners, members, and guests.

1. Open Outlook on the web, pick Groups, select the Group, and review members and owners.

• Check guest accounts in Azure AD to validate external identities.

Connect-AzureAD
Get-AzureADUser -Filter "userType eq 'Guest'" | Where-Object { $_.DisplayName -like '*<GroupName>*' }

Replace <GroupName> with a name or adjust the query; this lists guest users generally.

• Test access as a non-member: use an incognito/private browser window while signed into a different tenant account, or use a controlled guest test account to confirm what a guest sees.
• Search audit logs for group membership or sharing events. Use the Microsoft Purview audit search in the compliance center or PowerShell.

Connect-IPPSSession
Search-UnifiedAuditLog -StartDate 2024-01-01 -EndDate 2024-12-31 -RecordType AzureActiveDirectory -Operations AddMember

Replace dates; your tenant might use different record types. If Search-UnifiedAuditLog is unavailable, use the Purview audit UI.

How to interpret results

• Group members and guests listed in Outlook or the admin center are the people who can open the Planner plan.
• A guest test account should only see the plan if it’s a member or if files were shared externally.
• Audit results should show add/remove member events, sharing link creations, and external invitation events for the Group or SharePoint site.

Conclusion

Change a plan’s privacy by changing the underlying Microsoft 365 Group visibility. If the Planner UI doesn’t offer a visibility toggle, use Outlook, the Microsoft 365 admin center, or PowerShell. Control guest and sharing behaviors at the tenant level (Azure AD, SharePoint, Teams, sensitivity labels) to prevent accidental exposure. Verify access by reviewing Group membership, testing with a guest account, and checking audit logs before and after making changes.

Frequently Asked Questions

Does setting a Group to Private prevent admins from seeing content?

No. Tenant admins with the right roles (Global Admin, Compliance, or site collection admin via SharePoint) can access content through admin tools, discovery, or by changing membership. Private limits regular user discovery and access but not admin-level access.

Can I set a default privacy for new plans or Groups?

You can control who can create Groups and apply provisioning scripts or templates that set privacy defaults, or publish sensitivity labels that set default privacy for labeled Groups. There’s no single Planner setting to force a default; control comes from Group creation policies and templates.

What happens to Planner data when a plan or Group is deleted?

Deleting a Group deletes the Group, the connected Planner plan, and the SharePoint site according to tenant retention and recycle policies. Recoverability depends on retention settings; if you need to retain Planner content, configure retention policies in the compliance center.

How do retention labels interact with Planner content?

Retention labels applied to the Group or its SharePoint site govern files stored there. Planner task metadata itself is covered by Microsoft 365 retention features when configured for Groups/Planner; check Microsoft Purview retention settings to be sure tasks and attachments are retained according to your policy.