{
  "id": "CB-M365-TENANT-005",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-005",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-005.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-005.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-005",
    "title": "Prevent owners from managing group membership requests in My Groups",
    "finding": {
      "title": "Group owners approve membership requests in My Groups",
      "description": "Group owners can approve join requests in My Groups without any administrator involved, so access granted through groups grows outside of governance."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "groups",
      "my-groups",
      "governance"
    ],
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Groups > General > Owners can manage group membership requests in My Groups",
      "default_value": "No",
      "recommended_value": "No"
    },
    "description": "The group setting **Owners can manage group membership requests in My Groups** is set to\n**No**: users cannot request to join groups in My Groups and owners cannot approve such requests\nthere. Membership changes go through the processes the organization controls (entitlement\nmanagement, service desk, Teams).\n",
    "rationale": "Self-service join requests let users accumulate group memberships, and therefore access, on the\ndecision of an owner who may not know what the group grants. Turning it off keeps group-based\naccess decisions in governed processes.\n",
    "impact": "Users who used My Groups to join groups must ask an owner to add them directly, or use access\npackages where they exist.\n",
    "notes": "The setting has no public API.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Groups** > **General**, section **Self Service Group\n   Management**.\n3. Fail if **Owners can manage group membership requests in My Groups** is **Yes**.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least a Groups Administrator.\n2. Browse to **Entra ID** > **Groups** > **General**.\n3. Set **Owners can manage group membership requests in My Groups** to **No** and select\n   **Save**.\n",
      "rollback": "Set the option back to **Yes**.\n"
    },
    "references": [
      {
        "title": "Set up self-service group management in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/users/groups-self-service-management",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-004",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}