{
  "id": "CB-M365-TENANT-008",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-008",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-008.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-008.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-008",
    "title": "Apply expiration and naming policies to Microsoft 365 groups",
    "finding": {
      "title": "Microsoft 365 groups never expire and follow no naming rule",
      "description": "Abandoned groups and teams keep their members, guests and files forever, and group names can imitate official or administrative groups."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "groups",
      "microsoft-365-groups",
      "lifecycle",
      "naming-policy",
      "governance"
    ],
    "parameters": [
      {
        "name": "group_lifetime_days",
        "type": "integer",
        "description": "Lifetime of a Microsoft 365 group before its owners must renew it.",
        "unit": "days",
        "default": 365,
        "minimum": 30
      }
    ],
    "description": "- A group expiration policy applies to **All** Microsoft 365 groups with a lifetime of\n  `{{ group_lifetime_days }}` days or less. Owners are notified before expiry and renew active\n  groups; groups with recent activity are renewed automatically; groups without owners notify a\n  monitored address.\n- A group naming policy sets a prefix or suffix (for example `GRP-` or the department attribute)\n  and a list of blocked words (such as \"admin\", \"CEO\", \"payroll\", \"IT support\").\n",
    "rationale": "Groups and teams outlive their projects: without expiration, their guests, sharing links and\nfiles stay in place with nobody watching. A naming policy makes user-created groups easy to tell\napart from official ones and prevents names used to mislead users in address books and sharing\ndialogs.\n",
    "impact": "Owners receive renewal emails; an unrenewed group is soft-deleted and can be restored for 30\ndays. Expiration and naming policies need Microsoft Entra ID P1 for the members of the groups\nconcerned. Administrators are not bound by the naming policy.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Groups** > **Expiration**: **Group lifetime (in days)** is\n   `{{ group_lifetime_days }}` or less, **Email contact for groups with no owners** is set,\n   **Enable expiration for these Microsoft 365 groups** is **All**.\n3. Browse to **Entra ID** > **Groups** > **Naming policy**: **Group naming policy** defines a\n   prefix or suffix and **Blocked words** contains a list.\n4. Read-only PowerShell alternative (Microsoft Graph, scope `Directory.Read.All`):\n   `Get-MgGroupLifecyclePolicy | Select-Object GroupLifetimeInDays, ManagedGroupTypes, AlternateNotificationEmails`\n   and the `Group.Unified` values `PrefixSuffixNamingRequirement` and `CustomBlockedWordsList`\n   from `Get-MgBetaDirectorySetting`.\n5. Fail if no lifecycle policy applies to all groups, if the lifetime is longer than\n   `{{ group_lifetime_days }}` days, or if no naming rule is defined.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least a Groups Administrator.\n2. Browse to **Entra ID** > **Groups** > **Expiration**. Set **Group lifetime** to\n   `{{ group_lifetime_days }}` days, set the contact email, choose **All**, and **Save**.\n3. Browse to **Entra ID** > **Groups** > **Naming policy**. On **Group naming policy**, add a\n   prefix or suffix; on **Blocked words**, upload the list; **Save**.\n4. Equivalent with Microsoft Graph PowerShell:\n   `New-MgGroupLifecyclePolicy -GroupLifetimeInDays {{ group_lifetime_days }} -ManagedGroupTypes All -AlternateNotificationEmails <address>`.\n",
      "rollback": "Set **Enable expiration** to **None** and clear the naming rules.\n"
    },
    "references": [
      {
        "title": "Configure the expiration policy for Microsoft 365 groups",
        "url": "https://learn.microsoft.com/entra/identity/users/groups-lifecycle",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Enforce a group naming policy in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/users/groups-naming-policy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ASD's Blueprint for Secure Cloud, group expiration",
        "url": "https://blueprint.asd.gov.au/configuration/entra-id/groups/expiration/",
        "publisher": "Australian Signals Directorate",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2(3)",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-006",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-007",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}