Check ID:
Provider: Microsoft 365
Service:
Severity: HIGH
Categories:
Resource type:
admincenter_groups_not_public_visibilityProvider: Microsoft 365
Service:
admincenterSeverity: HIGH
Categories:
identity-access, e3Resource type:
NotDefinedWhat this check verifies
Microsoft 365 groups are assessed for their visibility setting. The finding highlights groups configured asPublic; groups set to Private align with the intended privacy posture.
Risk
Public visibility lets any authenticated tenant user discover and self-join, accessing group files, conversations, SharePoint sites, and calendars. This weakens confidentiality and can enable unauthorized changes that affect integrity.Recommendation
Set groups toPrivate by default and allow Public only for clearly non-sensitive communities.
Apply least privilege: restrict who can create or change visibility, require owner approval for membership, review access regularly, and use sensitivity labels to reinforce classification.
Remediation
- CLI
- Terraform
- Dashboard steps
Set-UnifiedGroup -Identity <GROUP_NAME_OR_ID> -AccessType Private
References
- https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/manage-groups?view=o365-worldwide
- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/microsoft-365-groups-governance
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = admincenter_groups_not_public_visibility. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks