{
  "id": "CB-M365-TENANT-004",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-004",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-004.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-004.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-004",
    "title": "Restrict access to group features in My Groups",
    "finding": {
      "title": "Users can browse and manage groups in My Groups",
      "description": "Any user can open My Groups to list the organization's groups and their members, which helps reconnaissance after an account compromise."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "groups",
      "my-groups",
      "reconnaissance"
    ],
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Groups > General > Restrict user ability to access groups features in My Groups",
      "default_value": "No",
      "recommended_value": "Yes"
    },
    "description": "The group setting **Restrict user ability to access groups features in My Groups** is set to\n**Yes**: non-administrators cannot use the group features of the My Groups portal\n(https://myaccount.microsoft.com/groups). Group and User Administrators keep read-only access\nthere.\n",
    "rationale": "My Groups lets users discover groups, their owners and members, and request to join them. An\nattacker with a regular account uses it to map teams and pick targets. Restricting the portal\nreduces this exposure when groups are managed by administrators or by Teams.\n",
    "impact": "Users no longer create or manage groups from My Groups; owners manage membership in Teams,\nOutlook or through the service desk. Self-service join requests stop working.\n",
    "notes": "The setting has no public API.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Groups** > **General**, section **Self Service Group\n   Management**.\n3. Fail if **Restrict user ability to access groups features in My Groups** is **No**.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least a Groups Administrator.\n2. Browse to **Entra ID** > **Groups** > **General**.\n3. Set **Restrict user ability to access groups features in My Groups** to **Yes** and select\n   **Save**.\n",
      "rollback": "Set the option back to **No**.\n"
    },
    "references": [
      {
        "title": "Set up self-service group management in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/users/groups-self-service-management",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1069.003"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-003",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-005",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}