Non-privileged users cannot create security groups

Check ID: entra_policy_default_users_cannot_create_security_groups
Provider: Azure
Service: entra
Severity: MEDIUM
Categories: identity-access, e3
Resource type: NotDefined

What this check verifies

Microsoft Entra authorization policy setting for default user role permissions governing creation of security groups by non-privileged users. The value of allowed_to_create_security_groups is examined to ensure group creation is limited to administrators across portals, API, and PowerShell.

Risk

Allowing standard users to create security groups drives entitlement sprawl and can grant unauthorized access when those groups are tied to apps, sites, or roles. This weakens least privilege, complicates audits, and enables lateral movement or data exfiltration via misassigned group-based permissions.

Recommendation

Restrict creation to administrators or a narrowly delegated role per least privilege. Set allowed_to_create_security_groups to false and use request/approval for new groups. Apply governance: naming standards, owner accountability, periodic access reviews, and monitor group lifecycle in audit logs.

Remediation

CLI
Terraform
Dashboard steps

az rest --method PATCH --url https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy --body '{"defaultUserRolePermissions":{"allowedToCreateSecurityGroups":false}}'

resource "azuread_authorization_policy" "<example_resource_name>" {
  default_user_role_permissions {
    allowed_to_create_security_groups = false # Critical: disables security group creation for non-privileged users
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_policy_default_users_cannot_create_security_groups. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Non-privileged user has multi-factor authentication enabled Non-admin users cannot register applications

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires