Microsoft 365 group creation by users is disabled

Check ID: entra_users_cannot_create_microsoft_365_groups
Provider: Azure
Service: entra
Severity: MEDIUM
Categories: identity-access, e3
Resource type: NotDefined

What this check verifies

Microsoft Entra directory setting Group.Unified governs who can create Microsoft 365 Groups. The evaluation inspects EnableGroupCreation and, when present, GroupCreationAllowedGroupId to determine if group creation is broadly allowed or restricted to a designated group.

Risk

Unrestricted group creation drives sprawl of Teams, SharePoint sites, and mailboxes, undermining confidentiality via public spaces and guest invites. Compromised accounts can create groups to stage exfiltration or impersonation. It also heightens integrity risks from unsanctioned owners and operational burden for lifecycle and governance.

Recommendation

Apply least privilege: set EnableGroupCreation=false and allow only a controlled group via GroupCreationAllowedGroupId. Use governed provisioning with naming policies, sensitivity labels, and expiration/owner reviews. Monitor creation events and enforce separation of duties with approvals and lifecycle management.

Remediation

CLI
Terraform
Dashboard steps

Update-MgDirectorySetting -DirectorySettingId (Get-MgDirectorySetting | Where-Object {$_.DisplayName -eq 'Group.Unified'}).Id -BodyParameter @{Values = @(@{Name = 'EnableGroupCreation'; Value = 'false'})}

data "azuread_directory_setting_template" "unified" {
  display_name = "Group.Unified"
}

resource "azuread_directory_setting" "example_resource_name" {
  template_id = data.azuread_directory_setting_template.unified.id

  values = {
    EnableGroupCreation = "false"
    # Critical: sets EnableGroupCreation to false so users cannot create Microsoft 365 groups
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_users_cannot_create_microsoft_365_groups. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Entra ID user with VM access has MFA enabled Custom role has permission to administer resource locks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires