{
  "id": "CB-M365-ADMIN-014",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-014",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-014.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-014.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-ADMIN-014",
    "title": "Protect groups that grant privileges or bypass security policies",
    "finding": {
      "title": "Sensitive groups can be modified by lower-privileged administrators or owners",
      "description": "A Groups Administrator, a User Administrator or a group owner can add an account to a group that grants a role or excludes it from Conditional Access, and escalate privileges."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "privileged-access",
      "groups",
      "role-assignable-groups",
      "administrative-units",
      "conditional-access"
    ],
    "description": "Every group that grants privileges or bypasses a security policy is protected against changes by\nanyone but highly privileged administrators. This covers groups:\n\n- assigned to a Microsoft Entra role, or eligible through PIM for Groups;\n- excluded from a Conditional Access policy (for example the emergency access group);\n- used for Intune role-based access control or for other admin delegations (Defender, Purview,\n  Azure).\n\nEach such group is either **role-assignable** (`isAssignableToRole` = true, created with\n**Microsoft Entra roles can be assigned to the group**), or member of a **restricted management\nadministrative unit**. Their owners are administrators themselves, not regular users.\n",
    "rationale": "Group membership is the weakest link in many privilege designs: roles such as Groups\nAdministrator, User Administrator or Intune Administrator, and group owners, can change ordinary\ngroups. If a group grants Global Administrator or excludes accounts from MFA, changing its\nmembers is a full escalation path. Role-assignable groups and restricted management\nadministrative units limit changes to Privileged Role Administrators or to admins scoped on the\nunit.\n",
    "impact": "The setting **Microsoft Entra roles can be assigned to the group** is set at creation and\ncannot be changed: existing groups must be replaced by new ones. Role-assignable groups cannot be\ndynamic and are limited in number per tenant. Restricted management administrative units need\nMicrosoft Entra ID P1 and a dedicated admin role scoped on the unit.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. List the sensitive groups: groups assigned to roles (**Entra ID** > **Roles & admins**, each\n   role > **Assignments**), groups excluded in **Conditional Access** > **Policies**, and\n   groups used in Intune (**Tenant administration** > **Roles**) and in other admin centers.\n3. For each group, open **Properties**: **Microsoft Entra roles can be assigned to the group**\n   is **Yes**, or the group appears in an administrative unit with **Restricted management\n   administrative unit** set to **Yes** (**Entra ID** > **Roles & admins** > **Admin\n   units**).\n4. Check **Owners**: only administrators.\n5. Read-only PowerShell alternative (Microsoft Graph, scopes `Group.Read.All`,\n   `AdministrativeUnit.Read.All`):\n   ```\n   Get-MgGroup -GroupId <id> -Property DisplayName,IsAssignableToRole\n   Get-MgDirectoryAdministrativeUnit -All -Property Id,DisplayName,IsMemberManagementRestricted |\n     Where-Object IsMemberManagementRestricted |\n     ForEach-Object { Get-MgDirectoryAdministrativeUnitMember -AdministrativeUnitId $_.Id -All }\n   ```\n6. Fail if a sensitive group is neither role-assignable nor in a restricted management\n   administrative unit, or if a regular user owns it.\n"
    },
    "remediation": {
      "manual": "1. For a group used in Microsoft Entra roles or Conditional Access exclusions: with a\n   Privileged Role Administrator, create a new security group with **Microsoft Entra roles can\n   be assigned to the group** set to **Yes**, copy the members, move the role assignment or\n   the policy exclusion to it, then delete the old group.\n2. For other sensitive groups (Intune RBAC, app access): with a Privileged Role Administrator,\n   create an administrative unit with **Restricted management administrative unit** set to\n   **Yes**, add the groups, and assign the admins who manage them a role scoped to the unit.\n3. Remove non-administrator owners from each sensitive group.\n4. Equivalent with Microsoft Graph PowerShell:\n   `New-MgGroup -DisplayName <name> -SecurityEnabled -MailEnabled:$false -MailNickname <alias> -IsAssignableToRole`\n   and `New-MgDirectoryAdministrativeUnit -DisplayName <name> -IsMemberManagementRestricted`.\n",
      "rollback": "Move the assignments back to the previous group, or remove the group from the administrative\nunit.\n"
    },
    "references": [
      {
        "title": "Use Microsoft Entra groups to manage role assignments",
        "url": "https://learn.microsoft.com/entra/identity/role-based-access-control/groups-concept",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Restricted management administrative units in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/role-based-access-control/admin-units-restricted-management",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R40",
        "relation": "partial",
        "note": "ANSSI asks for rights granted to groups; ours adds protection of those groups against tampering."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(1)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1098"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-ADMIN-006",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-034",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}