Users Can Create Office 365 Groups

Risk Level: High (not acceptable risk)

Rule ID: ActiveDirectory-019

Ensure that "Users can create Office 365 groups in Azure portals" is set to "No" within your Microsoft Entra ID settings in order to make sure that non-privileged users are not able to create Office 365 groups using the Access Panel and the Azure administration portal.

This rule resolution is part of the Conformity Security & Compliance tool for Azure.

Security

Depending on your business needs, you might want to control who has the ability to create Office 365 groups. When "Users can create Office 365 groups in Azure portals" feature is enabled, all users in your Microsoft Entra ID account are allowed to create new Office 365 groups and add members to those groups. Unless your business logic requires delegation to create groups, Office 365 group creation should be restricted to Microsoft Entra ID administrators only.

Audit

To determine if non-privileged users have the ability to create Microsoft Office 365 groups within Azure portals, perform the following actions:

Note: Retrieving the feature configuration status using Microsoft Graph API or Azure CLI is not currently supported.

Using Azure Console

01 Sign in to Azure Management Console.

02 Navigate to Microsoft Entra ID blade at https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview.

03 In the navigation panel, select Groups.

04 In the Settings section, select General to access Microsoft Entra ID user group general settings.

05 On the General settings page, under Office 365 Groups, check Users can create Office 365 groups in Azure portals setting configuration. If the verified setting is set to Yes, any Microsoft Entra ID users, including users without administrative roles, can create Office 365 groups using the Access Panel and the Azure administration portal, thus the current Microsoft Entra group configuration is not compliant.

06 Repeat steps no. 3 – 5 for each Microsoft Entra ID that you want to examine.

Remediation / Resolution

By setting "Users can create Office 365 groups in Azure portals" to "No", only Microsoft Entra ID administrators can create Office 365 groups. To disable the feature, perform the following actions:

Note: Restricting Office 365 group creation to Microsoft Entra ID administrators only using Microsoft Graph API or Azure CLI is not currently supported.

Using Azure Console

01 Sign in to Azure Management Console.

02 Navigate to Microsoft Entra ID blade at https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview.

03 In the navigation panel, select Groups.

04 In the Settings section, select General to access Microsoft Entra ID user group general settings.

05 On the General settings page, under Security Groups, select No next to Users can create Office 365 groups in Azure portals configuration setting to disable the ability to create Office 365 groups for non-privileged users.

06 Click Save to apply the changes. If the request is successful, the following message should be displayed: "Successfully updated group settings". Once the configuration changes are active, only Microsoft Entra ID users with administration roles can create Office 365 groups using the Access Panel and the Azure administration portal.

07 Repeat steps no. 3 – 6 for each Microsoft Entra ID that you want to reconfigure in order to restrict Office 365 groups creation to Microsoft Entra ID administrators only.

References

Azure Official Documentation
Manage who can create Microsoft 365 Groups
CIS Microsoft Azure Foundations

Publication date Aug 30, 2019

Unlock the Remediation Steps

Free 30-day Trial

Automatically audit your configurations with Conformity
and gain access to our cloud security platform.

No thanks, back to article

You are auditing:

Users Can Create Office 365 Groups

Risk Level: High

Audit

Using Azure Console

Remediation / Resolution

Using Azure Console

References

Related ActiveDirectory rules