Restrict non-admin users from creating security groups

MT.1069LowEntra IDUser and directory settings

Contributed by Marcel N.All contributors →

Part of Maester · Entra ID · User and directory settings · All checks

Invoke-Maester -TestId MT.1069

Overview

Description

Verifies that security group creation is restricted to admin users only in the Entra ID tenant.

Why This Matters

Restricting security group creation to administrators ensures proper governance, maintains the principle of least privilege, and supports regulatory compliance requirements.

Remediation action

This setting can be changed via user settings in the Microsoft Entra or Azure portal or via Microsoft Graph API / Graph PowerShell Module.

Admin Portal:

Go to Entra Admin Center
Navigate to Users → User settings
Set Users can create security groups to No
Click Save

Use the following PowerShell commands to restrict security group creation:

# Connect to Microsoft Graph with appropriate permissions
Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"

# Get the current authorization policy
$authPolicy = Get-MgPolicyAuthorizationPolicy

# Update the policy to restrict security group creation
$params = @{
    defaultUserRolePermissions = @{
        allowedToCreateSecurityGroups = $false
    }
}

Update-MgPolicyAuthorizationPolicy -AuthorizationPolicyId $authPolicy.Id -BodyParameter $params

Details

Every attribute of this check

Field	Value
Test ID	MT.1069
Severity	Low
Suite	Maester
Product	Entra ID
Feature	User and directory settings
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
Supports controls	nist-800-53-r5:AC-6
PowerShell test	Test-MtSecurityGroupCreationRestricted
Services	Graph

Source

Test: tests/maester/entra/Test.MT.1069.ps1
Documentation: tests/maester/entra/Test.MT.1069.md