Restrict security group creation to administrators

Description

The setting Users can create security groups is set to No (defaultUserRolePermissions.allowedToCreateSecurityGroups = false). Only administrators with a group management role create security groups.

Rationale

Security groups grant access to applications, SharePoint sites and Conditional Access scopes. User-created groups multiply without owners or review, and a group whose name looks official can be used by mistake in an access decision.

Impact

Users who need a security group ask the service desk or a Groups Administrator. Group creation for teams and collaboration uses Microsoft 365 groups (CB-M365-TENANT-006).

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Users > User settings (or Entra ID > Groups > General) and read Users can create security groups.
3. Read-only PowerShell alternative (Microsoft Graph, scope Policy.Read.All): (Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions.AllowedToCreateSecurityGroups.
4. Fail if the setting is Yes (value true).

Remediation

1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.
2. Browse to Entra ID > Users > User settings.
3. Set Users can create security groups to No and select Save.
4. Equivalent with Microsoft Graph PowerShell (scope Policy.ReadWrite.Authorization): Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{ AllowedToCreateSecurityGroups = $false }.

Rollback

Set the option back to Yes.

References

• What are the default user permissions in Microsoft Entra ID? Microsoft, vendor-doc, accessed 2026-10-24
• Set up self-service group management in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-TENANT-006 Restrict Microsoft 365 group creation to an approved group
• related CB-M365-TENANT-004 Restrict access to group features in My Groups

People and lifecycle