Apply expiration and naming policies to Microsoft 365 groups

Description

• A group expiration policy applies to All Microsoft 365 groups with a lifetime of {{ group_lifetime_days }} days or less. Owners are notified before expiry and renew active groups; groups with recent activity are renewed automatically; groups without owners notify a monitored address.
• A group naming policy sets a prefix or suffix (for example GRP- or the department attribute) and a list of blocked words (such as "admin", "CEO", "payroll", "IT support").

Rationale

Groups and teams outlive their projects: without expiration, their guests, sharing links and files stay in place with nobody watching. A naming policy makes user-created groups easy to tell apart from official ones and prevents names used to mislead users in address books and sharing dialogs.

Impact

Owners receive renewal emails; an unrenewed group is soft-deleted and can be restored for 30 days. Expiration and naming policies need Microsoft Entra ID P1 for the members of the groups concerned. Administrators are not bound by the naming policy.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Groups > Expiration: Group lifetime (in days) is {{ group_lifetime_days }} or less, Email contact for groups with no owners is set, Enable expiration for these Microsoft 365 groups is All.
3. Browse to Entra ID > Groups > Naming policy: Group naming policy defines a prefix or suffix and Blocked words contains a list.
4. Read-only PowerShell alternative (Microsoft Graph, scope Directory.Read.All): Get-MgGroupLifecyclePolicy | Select-Object GroupLifetimeInDays, ManagedGroupTypes, AlternateNotificationEmails and the Group.Unified values PrefixSuffixNamingRequirement and CustomBlockedWordsList from Get-MgBetaDirectorySetting.
5. Fail if no lifecycle policy applies to all groups, if the lifetime is longer than {{ group_lifetime_days }} days, or if no naming rule is defined.

Remediation

1. Sign in to the Microsoft Entra admin center as at least a Groups Administrator.
2. Browse to Entra ID > Groups > Expiration. Set Group lifetime to {{ group_lifetime_days }} days, set the contact email, choose All, and Save.
3. Browse to Entra ID > Groups > Naming policy. On Group naming policy, add a prefix or suffix; on Blocked words, upload the list; Save.
4. Equivalent with Microsoft Graph PowerShell: New-MgGroupLifecyclePolicy -GroupLifetimeInDays {{ group_lifetime_days }} -ManagedGroupTypes All -AlternateNotificationEmails <address>.

Rollback

Set Enable expiration to None and clear the naming rules.

References

• Configure the expiration policy for Microsoft 365 groups Microsoft, vendor-doc, accessed 2026-10-24
• Enforce a group naming policy in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24
• ASD's Blueprint for Secure Cloud, group expiration Australian Signals Directorate, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-TENANT-006 Restrict Microsoft 365 group creation to an approved group
• related CB-M365-TENANT-007 Allow public Microsoft 365 groups only when approved

People and lifecycle