CIS.M365.5.1.3.4 - (L2) Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'

Contributed by jeremy finneyAll contributors →

Overview

5.1.3.4 (L2) Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'

All users within a Microsoft Entra organization are permitted to create new Microsoft 365 groups and add members to those groups through the Azure portal, API, or PowerShell. Newly created groups also appear in the Access Panel for all other users. When the applicable group policy settings allow it, users can submit requests to join these groups.

The recommended state is No.

Rationale

Restricting Microsoft 365 group creation to administrators only ensures that creation of Microsoft 365 groups is controlled by the administrator. Appropriate groups should be created and managed by the administrator and group creation rights should not be delegated to any other user.

Impact

Enabling this setting could create a number of requests that would need to be managed by an administrator.

Remediation action

To remediate using the UI:

1. Navigate to Microsoft Entra admin center.
2. Expand Entra ID > Groups and select General.
3. Set Users can create Microsoft 365 groups in Azure portals, API or PowerShell to No.
4. Click Save.

To remediate using the Microsoft Graph API:

1. Execute a PATCH request to the following relative URI: v1.0/groupSettings
2. Target the object with the templateId of 62375ab9-6b52-47ed-826b-58e47e0e304b.
3. Update EnableGroupCreation to false.

Note: If a group with the above templateId doesn't exist this means the defaults are present and it would be advisable to use the UI to remediate, as this will automatically create the Group.Unified object with its defaults. Microsoft's documentation does cover using a POST request to build this using the API, however.

Related links

• Microsoft Entra admin center - Group general settings
• Manage who can create Microsoft 365 Groups
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.1.3.4

Test Metadata

Field	Value
Test ID	CIS.M365.5.1.3.4
Severity	Low
Suite	CIS
Product	Entra ID
Related products	Teams
Feature	Groups
Area	Access control
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	None
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.1.3.4
Benchmark level	L2
Benchmark profiles	E3 Level 2
Supports controls	cis-m365:5.1.3.4, nist-800-53-r5:AC-6
PowerShell test	Test-MtCisUserCannotCreateM365Group
Services	Graph

Source

• Test: tests/cis/Test.CIS.M365.5.1.3.4.ps1
• Documentation: tests/cis/Test.CIS.M365.5.1.3.4.md