{
  "id": "CB-M365-TENANT-006",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-006",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-006.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-006.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-006",
    "title": "Restrict Microsoft 365 group creation to an approved group",
    "finding": {
      "title": "Any user can create Microsoft 365 groups and Teams",
      "description": "Every user can create groups, teams and SharePoint sites, which leads to unmanaged workspaces, inconsistent sharing settings and data with no owner."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "groups",
      "microsoft-365-groups",
      "teams",
      "governance"
    ],
    "parameters": [
      {
        "name": "group_creators_group",
        "type": "string",
        "description": "Display name of the security group whose members may create Microsoft 365 groups.",
        "default": "GRP-M365-Group-Creators"
      }
    ],
    "description": "Microsoft 365 group creation (which also creates Teams teams, SharePoint team sites and Planner\nplans) is limited to administrators and to the members of the security group\n`{{ group_creators_group }}`:\n\n- the `Group.Unified` directory setting has `EnableGroupCreation` = `false` and\n  `GroupCreationAllowedGroupId` = the object ID of that group;\n- the Entra setting **Users can create Microsoft 365 groups in Azure portals, API or\n  PowerShell** is **No**.\n",
    "rationale": "Open group creation produces many workspaces without a clear owner, purpose or classification,\neach with its own guest access and sharing. Limiting creation to a trained group, or to a request\nprocess, keeps workspaces governed and makes labels, naming and expiration policies effective.\n",
    "impact": "Users who are not in the group request new teams through a form or the service desk. The members\nof the allowed group need a Microsoft Entra ID P1 license. The Entra portal toggle alone only\ncovers the Azure and Entra portals, API and PowerShell; the directory setting also covers\nOutlook, Teams, SharePoint and Planner.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader. Browse to **Entra ID** > **Groups** > **General** and read **Users can\n   create Microsoft 365 groups in Azure portals, API or PowerShell**.\n2. Connect to Microsoft Graph PowerShell (scope `Directory.Read.All`) and run:\n   ```\n   (Get-MgBetaDirectorySetting | Where-Object DisplayName -eq 'Group.Unified').Values |\n     Where-Object Name -in 'EnableGroupCreation','GroupCreationAllowedGroupId'\n   ```\n   (or `GET https://graph.microsoft.com/v1.0/groupSettings`).\n3. Check that the group ID resolves to `{{ group_creators_group }}` with\n   `Get-MgGroup -GroupId <id>`.\n4. Fail if the portal setting is **Yes**, if no `Group.Unified` setting exists, if\n   `EnableGroupCreation` is `true`, or if `GroupCreationAllowedGroupId` is empty or points to\n   another group.\n"
    },
    "remediation": {
      "manual": "1. Create the security group `{{ group_creators_group }}` and add the authorized creators.\n2. Connect to Microsoft Graph PowerShell as at least a Groups Administrator (scopes\n   `Directory.ReadWrite.All`, `Group.Read.All`).\n3. If no `Group.Unified` setting exists, create it from the template:\n   ```\n   $tpl = Get-MgBetaDirectorySettingTemplate | Where-Object DisplayName -eq 'Group.Unified'\n   New-MgBetaDirectorySetting -BodyParameter @{ templateId = $tpl.Id; values = @() }\n   ```\n4. Set the values:\n   ```\n   $gid = (Get-MgGroup -Filter \"displayName eq '{{ group_creators_group }}'\").Id\n   $s = Get-MgBetaDirectorySetting | Where-Object DisplayName -eq 'Group.Unified'\n   $v = $s.Values\n   ($v | Where-Object Name -eq 'EnableGroupCreation').Value = 'false'\n   ($v | Where-Object Name -eq 'GroupCreationAllowedGroupId').Value = $gid\n   Update-MgBetaDirectorySetting -DirectorySettingId $s.Id -Values $v\n   ```\n5. In the Entra admin center, set **Users can create Microsoft 365 groups in Azure portals,\n   API or PowerShell** to **No**.\n",
      "rollback": "Set `EnableGroupCreation` back to `true` with `Update-MgBetaDirectorySetting`.\n"
    },
    "references": [
      {
        "title": "Manage who can create Microsoft 365 groups",
        "url": "https://learn.microsoft.com/microsoft-365/solutions/manage-creation-of-groups",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Configure group settings using PowerShell",
        "url": "https://learn.microsoft.com/entra/identity/users/groups-settings-cmdlets",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-003",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-007",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-008",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}