# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-TENANT-008
title: Apply expiration and naming policies to Microsoft 365 groups
finding:
  title: Microsoft 365 groups never expire and follow no naming rule
  description: Abandoned groups and teams keep their members, guests and files forever, and group names can imitate official or administrative groups.
status: active
profiles: [hardened]
risk:
  severity: low
assessment: manual
tags: [groups, microsoft-365-groups, lifecycle, naming-policy, governance]

parameters:
  - name: group_lifetime_days
    type: integer
    description: Lifetime of a Microsoft 365 group before its owners must renew it.
    unit: days
    default: 365
    minimum: 30

description: |
  - A group expiration policy applies to **All** Microsoft 365 groups with a lifetime of
    `{{ group_lifetime_days }}` days or less. Owners are notified before expiry and renew active
    groups; groups with recent activity are renewed automatically; groups without owners notify a
    monitored address.
  - A group naming policy sets a prefix or suffix (for example `GRP-` or the department attribute)
    and a list of blocked words (such as "admin", "CEO", "payroll", "IT support").
rationale: |
  Groups and teams outlive their projects: without expiration, their guests, sharing links and
  files stay in place with nobody watching. A naming policy makes user-created groups easy to tell
  apart from official ones and prevents names used to mislead users in address books and sharing
  dialogs.
impact: |
  Owners receive renewal emails; an unrenewed group is soft-deleted and can be restored for 30
  days. Expiration and naming policies need Microsoft Entra ID P1 for the members of the groups
  concerned. Administrators are not bound by the naming policy.

audit:
  manual: |
    1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a
       Global Reader.
    2. Browse to **Entra ID** > **Groups** > **Expiration**: **Group lifetime (in days)** is
       `{{ group_lifetime_days }}` or less, **Email contact for groups with no owners** is set,
       **Enable expiration for these Microsoft 365 groups** is **All**.
    3. Browse to **Entra ID** > **Groups** > **Naming policy**: **Group naming policy** defines a
       prefix or suffix and **Blocked words** contains a list.
    4. Read-only PowerShell alternative (Microsoft Graph, scope `Directory.Read.All`):
       `Get-MgGroupLifecyclePolicy | Select-Object GroupLifetimeInDays, ManagedGroupTypes, AlternateNotificationEmails`
       and the `Group.Unified` values `PrefixSuffixNamingRequirement` and `CustomBlockedWordsList`
       from `Get-MgBetaDirectorySetting`.
    5. Fail if no lifecycle policy applies to all groups, if the lifetime is longer than
       `{{ group_lifetime_days }}` days, or if no naming rule is defined.

remediation:
  manual: |
    1. Sign in to the Microsoft Entra admin center as at least a Groups Administrator.
    2. Browse to **Entra ID** > **Groups** > **Expiration**. Set **Group lifetime** to
       `{{ group_lifetime_days }}` days, set the contact email, choose **All**, and **Save**.
    3. Browse to **Entra ID** > **Groups** > **Naming policy**. On **Group naming policy**, add a
       prefix or suffix; on **Blocked words**, upload the list; **Save**.
    4. Equivalent with Microsoft Graph PowerShell:
       `New-MgGroupLifecyclePolicy -GroupLifetimeInDays {{ group_lifetime_days }} -ManagedGroupTypes All -AlternateNotificationEmails <address>`.
  rollback: |
    Set **Enable expiration** to **None** and clear the naming rules.

references:
  - title: Configure the expiration policy for Microsoft 365 groups
    url: https://learn.microsoft.com/entra/identity/users/groups-lifecycle
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Enforce a group naming policy in Microsoft Entra ID
    url: https://learn.microsoft.com/entra/identity/users/groups-naming-policy
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: ASD's Blueprint for Secure Cloud, group expiration
    url: https://blueprint.asd.gov.au/configuration/entra-id/groups/expiration/
    publisher: Australian Signals Directorate
    kind: guide
    accessed: 2026-10-24
mappings:
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-2
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-2(3)
    relation: related
related_controls:
  - id: CB-M365-TENANT-006
    type: related
  - id: CB-M365-TENANT-007
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24