# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-TENANT-005
title: Prevent owners from managing group membership requests in My Groups
finding:
  title: Group owners approve membership requests in My Groups
  description: Group owners can approve join requests in My Groups without any administrator involved, so access granted through groups grows outside of governance.
status: active
profiles: [baseline]
risk:
  severity: low
assessment: manual
tags: [entra-id, groups, my-groups, governance]

setting:
  location: Microsoft Entra admin center > Entra ID > Groups > General > Owners can manage group membership requests in My Groups
  default_value: "No"
  recommended_value: "No"

description: |
  The group setting **Owners can manage group membership requests in My Groups** is set to
  **No**: users cannot request to join groups in My Groups and owners cannot approve such requests
  there. Membership changes go through the processes the organization controls (entitlement
  management, service desk, Teams).
rationale: |
  Self-service join requests let users accumulate group memberships, and therefore access, on the
  decision of an owner who may not know what the group grants. Turning it off keeps group-based
  access decisions in governed processes.
impact: |
  Users who used My Groups to join groups must ask an owner to add them directly, or use access
  packages where they exist.
notes: |
  The setting has no public API.

audit:
  manual: |
    1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a
       Global Reader.
    2. Browse to **Entra ID** > **Groups** > **General**, section **Self Service Group
       Management**.
    3. Fail if **Owners can manage group membership requests in My Groups** is **Yes**.

remediation:
  manual: |
    1. Sign in to the Microsoft Entra admin center as at least a Groups Administrator.
    2. Browse to **Entra ID** > **Groups** > **General**.
    3. Set **Owners can manage group membership requests in My Groups** to **No** and select
       **Save**.
  rollback: |
    Set the option back to **Yes**.

references:
  - title: Set up self-service group management in Microsoft Entra ID
    url: https://learn.microsoft.com/entra/identity/users/groups-self-service-management
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "5.1.3.3"
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-2
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-6
    relation: related
related_controls:
  - id: CB-M365-TENANT-004
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24