Detections
Analytics

5.1.3.4 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'

Information

All users within a Microsoft Entra organization are permitted to create new Microsoft 365 groups and add members to those groups through the Azure portal, API, or PowerShell. Newly created groups also appear in the Access Panel for all other users. When the applicable group policy settings allow it, users can submit requests to join these groups.

The recommended state is No.

Restricting Microsoft 365 group creation to administrators only ensures that creation of Microsoft 365 groups is controlled by the administrator. Appropriate groups should be created and managed by the administrator and group creation rights should not be delegated to any other user.

Solution

To remediate using the UI:

 - Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
 - Expand Entra ID > Groups and select General.
 - Set Users can create Microsoft 365 groups in Azure portals, API or PowerShell to No
 - Click Save.

To remediate using the Microsoft Graph API:

 - Execute a PATCH request to the following relative URI:

v1.0/groupSettings

 - Target the object with the templateId of 62375ab9-6b52-47ed-826b-58e47e0e304b
 - Update EnableGroupCreation to false.

Note: If a group with the above templateId doesn't exist this means the defaults are present and it would be advisable to use the UI to remediate, as this will automatically create the Group.Unified object with its defaults. Microsoft's documentation does cover using a POST request to build this using the API, however.

Impact:

Enabling this setting could create a number of requests that would need to be managed by an administrator.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4), CSCv7|14.6

Plugin: microsoft_azure

Control ID: bb43eb3aaffb5dafedc5e476805db55bad18c8db26824c6328e4a13a02252b77