Detections
Analytics

1.2.1 (L2) Ensure that only organizationally managed/approved public groups exist

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Microsoft 365 Groups is the foundational membership service that drives all teamwork across Microsoft 365. With Microsoft 365 Groups, you can give a group of people access to a collection of shared resources. When a new group is created in the Administration panel, the default privacy value of the group is "Public". (In this case, 'public' means accessible to the identities within the organization without requiring group owner authorization to join.)

Ensure that Microsoft 365 Groups are set to Private in the Administration panel.

 Note: Although there are several different group types, this recommendation concerns Microsoft 365 Groups specifically.

If group privacy is not controlled, any user may access sensitive information, depending on the group they try to access.

When the privacy value of a group is set to "Public," users may access data related to this group (e.g. SharePoint) via three methods:

 - The Azure Portal: Users can add themselves to the public group via the Azure Portal; however, administrators are notified when users access the Portal.
 - Access Requests: Users can request to join the group via the Groups application in the Access Panel. This provides the user with immediate access to the group, even though they are required to send a message to the group owner when requesting to join.
 - SharePoint URL: Users can directly access a group via its SharePoint URL, which is usually guessable and can be found in the Groups application within the Access Panel.

Solution

To remediate using the UI:

 - Navigate to Microsoft 365 admin center https://admin.microsoft.com.
 - Click to expand Teams & groups select Active teams & groups ..
 - On the Active teams and groups page, select the group's name that is public.
 - On the popup groups name page, Select Settings.
 - Under Privacy, select Private.

Impact:

If the recommendation is applied, group owners could receive more access requests than usual, especially regarding groups originally meant to be public.

See Also

https://workbench.cisecurity.org/benchmarks/24619

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|13.1

Plugin: microsoft_azure

Control ID: b1fa545446b8c56bc59c2a3f7b301caeee7817e406196c68097bfa4d3a83a2bf