Allow public Microsoft 365 groups only when approved

Description

Every Microsoft 365 group (and team) with privacy set to Public is listed in the register of approved public groups, with an owner and a purpose (for example an organization-wide announcements team). All other groups are Private.

Sensitivity labels for groups and sites can enforce privacy at creation (DATA domain).

Rationale

Members of the organization can join a public group without approval and get access to its conversations, files and SharePoint site. Groups created for a project often start public by default and end up holding sensitive documents. Search and Copilot also surface public group content to every user.

Impact

Users who relied on joining public groups must ask the owner. Owners of groups switched to private review the existing members, who keep their access.

Audit

1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a Global Reader.
2. Browse to Teams & groups > Active teams & groups and filter or sort on the Privacy column to list Public groups.
3. Read-only PowerShell alternative (Microsoft Graph, scope Group.Read.All):

   Get-MgGroup -All -Filter "groupTypes/any(c:c eq 'Unified')" -Property DisplayName,Visibility,Id |
     Where-Object Visibility -eq 'Public'
   

   or, in Exchange Online PowerShell, Get-UnifiedGroup -ResultSize Unlimited | Where-Object AccessType -eq 'Public'.
4. Fail if a public group is not in the approved register.

Remediation

1. For each unapproved public group, contact the owner and confirm the change.
2. In the Microsoft 365 admin center, open the group > Settings > Privacy > Private, and save (Groups Administrator).
3. Equivalent with Microsoft Graph PowerShell: Update-MgGroup -GroupId <id> -Visibility Private, or in Exchange Online Set-UnifiedGroup -Identity <group> -AccessType Private.

Rollback

Set the group privacy back to Public.

References

• Manage a group in the Microsoft 365 admin center Microsoft, vendor-doc, accessed 2026-10-24
• Compare types of groups in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-TENANT-006 Restrict Microsoft 365 group creation to an approved group
• related CB-M365-TENANT-008 Apply expiration and naming policies to Microsoft 365 groups
• related CB-M365-DATA-006 Extend sensitivity labels to SharePoint, groups and sites, with default and automatic labelling

People and lifecycle