Restrict access to group features in My Groups

Description

The group setting Restrict user ability to access groups features in My Groups is set to Yes: non-administrators cannot use the group features of the My Groups portal (https://myaccount.microsoft.com/groups). Group and User Administrators keep read-only access there.

The setting has no public API.

Rationale

My Groups lets users discover groups, their owners and members, and request to join them. An attacker with a regular account uses it to map teams and pick targets. Restricting the portal reduces this exposure when groups are managed by administrators or by Teams.

Impact

Users no longer create or manage groups from My Groups; owners manage membership in Teams, Outlook or through the service desk. Self-service join requests stop working.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Groups > General, section Self Service Group Management.
3. Fail if Restrict user ability to access groups features in My Groups is No.

Remediation

1. Sign in to the Microsoft Entra admin center as at least a Groups Administrator.
2. Browse to Entra ID > Groups > General.
3. Set Restrict user ability to access groups features in My Groups to Yes and select Save.

Rollback

Set the option back to No.

References

• Set up self-service group management in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-TENANT-003 Restrict security group creation to administrators
• related CB-M365-TENANT-005 Prevent owners from managing group membership requests in My Groups

People and lifecycle