{
  "id": "CB-M365-TENANT-003",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-003",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-003.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-003.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-003",
    "title": "Restrict security group creation to administrators",
    "finding": {
      "title": "Any user can create security groups",
      "description": "Users can create security groups that may later be used to grant access to applications, files or policies, without any governance."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "groups",
      "security-groups",
      "governance"
    ],
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Users > User settings > Users can create security groups (also under Entra ID > Groups > General)",
      "default_value": "Yes",
      "recommended_value": "No"
    },
    "description": "The setting **Users can create security groups** is set to **No**\n(`defaultUserRolePermissions.allowedToCreateSecurityGroups` = `false`). Only administrators with\na group management role create security groups.\n",
    "rationale": "Security groups grant access to applications, SharePoint sites and Conditional Access scopes.\nUser-created groups multiply without owners or review, and a group whose name looks official can\nbe used by mistake in an access decision.\n",
    "impact": "Users who need a security group ask the service desk or a Groups Administrator. Group creation\nfor teams and collaboration uses Microsoft 365 groups (CB-M365-TENANT-006).\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Users** > **User settings** (or **Entra ID** > **Groups** >\n   **General**) and read **Users can create security groups**.\n3. Read-only PowerShell alternative (Microsoft Graph, scope `Policy.Read.All`):\n   `(Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions.AllowedToCreateSecurityGroups`.\n4. Fail if the setting is **Yes** (value `true`).\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.\n2. Browse to **Entra ID** > **Users** > **User settings**.\n3. Set **Users can create security groups** to **No** and select **Save**.\n4. Equivalent with Microsoft Graph PowerShell (scope `Policy.ReadWrite.Authorization`):\n   `Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{ AllowedToCreateSecurityGroups = $false }`.\n",
      "rollback": "Set the option back to **Yes**.\n"
    },
    "references": [
      {
        "title": "What are the default user permissions in Microsoft Entra ID?",
        "url": "https://learn.microsoft.com/entra/fundamentals/users-default-permissions",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set up self-service group management in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/users/groups-self-service-management",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-006",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-004",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}