Prevent owners from managing group membership requests in My Groups

Description

The group setting Owners can manage group membership requests in My Groups is set to No: users cannot request to join groups in My Groups and owners cannot approve such requests there. Membership changes go through the processes the organization controls (entitlement management, service desk, Teams).

The setting has no public API.

Rationale

Self-service join requests let users accumulate group memberships, and therefore access, on the decision of an owner who may not know what the group grants. Turning it off keeps group-based access decisions in governed processes.

Impact

Users who used My Groups to join groups must ask an owner to add them directly, or use access packages where they exist.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Groups > General, section Self Service Group Management.
3. Fail if Owners can manage group membership requests in My Groups is Yes.

Remediation

1. Sign in to the Microsoft Entra admin center as at least a Groups Administrator.
2. Browse to Entra ID > Groups > General.
3. Set Owners can manage group membership requests in My Groups to No and select Save.

Rollback

Set the option back to Yes.

References

• Set up self-service group management in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-TENANT-004 Restrict access to group features in My Groups

People and lifecycle