{
  "id": "CB-M365-TENANT-007",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-007",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-007.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-007.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-007",
    "title": "Allow public Microsoft 365 groups only when approved",
    "finding": {
      "title": "Unapproved public Microsoft 365 groups exist",
      "description": "Any user in the organization can join a public group and read its mailbox, files and Teams channels without approval from the owner."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "groups",
      "microsoft-365-groups",
      "teams",
      "oversharing",
      "data-exposure"
    ],
    "description": "Every Microsoft 365 group (and team) with privacy set to **Public** is listed in the register of\napproved public groups, with an owner and a purpose (for example an organization-wide\nannouncements team). All other groups are **Private**.\n",
    "rationale": "Members of the organization can join a public group without approval and get access to its\nconversations, files and SharePoint site. Groups created for a project often start public by\ndefault and end up holding sensitive documents. Search and Copilot also surface public group\ncontent to every user.\n",
    "impact": "Users who relied on joining public groups must ask the owner. Owners of groups switched to\nprivate review the existing members, who keep their access.\n",
    "notes": "Sensitivity labels for groups and sites can enforce privacy at creation (DATA domain).\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a\n   Global Reader.\n2. Browse to **Teams & groups** > **Active teams & groups** and filter or sort on the\n   **Privacy** column to list **Public** groups.\n3. Read-only PowerShell alternative (Microsoft Graph, scope `Group.Read.All`):\n   ```\n   Get-MgGroup -All -Filter \"groupTypes/any(c:c eq 'Unified')\" -Property DisplayName,Visibility,Id |\n     Where-Object Visibility -eq 'Public'\n   ```\n   or, in Exchange Online PowerShell, `Get-UnifiedGroup -ResultSize Unlimited | Where-Object AccessType -eq 'Public'`.\n4. Fail if a public group is not in the approved register.\n"
    },
    "remediation": {
      "manual": "1. For each unapproved public group, contact the owner and confirm the change.\n2. In the Microsoft 365 admin center, open the group > **Settings** > **Privacy** >\n   **Private**, and save (Groups Administrator).\n3. Equivalent with Microsoft Graph PowerShell: `Update-MgGroup -GroupId <id> -Visibility Private`,\n   or in Exchange Online `Set-UnifiedGroup -Identity <group> -AccessType Private`.\n",
      "rollback": "Set the group privacy back to **Public**.\n"
    },
    "references": [
      {
        "title": "Manage a group in the Microsoft 365 admin center",
        "url": "https://learn.microsoft.com/microsoft-365/admin/create-groups/manage-groups",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Compare types of groups in Microsoft 365",
        "url": "https://learn.microsoft.com/microsoft-365/admin/create-groups/compare-groups",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-21",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-006",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-008",
        "type": "related"
      },
      {
        "id": "CB-M365-DATA-006",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}