Back to Checks
azure

Authorization policy disallows non-privileged users from creating security groups

entra_policy_default_users_cannot_create_security_groups
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra authorization policy setting for default user role permissions governing creation of security groups by non-privileged users.

The value of allowed_to_create_security_groups is examined to ensure group creation is limited to administrators across portals, API, and PowerShell.

Prowler logoProwlerprowler-provider-azure

Risk

Allowing standard users to create security groups drives entitlement sprawl and can grant unauthorized access when those groups are tied to apps, sites, or roles. This weakens least privilege, complicates audits, and enables lateral movement or data exfiltration via misassigned group-based permissions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks entra_policy_default_users_cannot_create_security_groups

Recommendation

Restrict creation to administrators or a narrowly delegated role per least privilege. Set allowed_to_create_security_groups to false and use request/approval for new groups. Apply governance: naming standards, owner accountability, periodic access reviews, and monitor group lifecycle in audit logs.

Remediation

CLI

az rest --method PATCH --url https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy --body '{"defaultUserRolePermissions":{"allowedToCreateSecurityGroups":false}}'

Terraform

resource "azuread_authorization_policy" "<example_resource_name>" {
  default_user_role_permissions {
    allowed_to_create_security_groups = false # Critical: disables security group creation for non-privileged users
  }
}

Other

1Sign in to the Microsoft Entra admin center
2Go to Identity > Users > User settings
3Find "Users can create security groups in Azure portals, API, or PowerShell"
4Set it to "No"
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.entra.entra_client import entra_client


class entra_policy_default_users_cannot_create_security_groups(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for tenant_domain, auth_policy in entra_client.authorization_policy.items():
            report = Check_Report_Azure(metadata=self.metadata(), resource=auth_policy)
            report.subscription = f"Tenant: {tenant_domain}"
            report.resource_name = getattr(auth_policy, "name", "Authorization Policy")
            report.resource_id = auth_policy.id
            report.status = "FAIL"
            report.status_extended = "Non-privileged users are able to create security groups via the Access Panel and the Azure administration portal."

            if getattr(
                auth_policy, "default_user_role_permissions", None
            ) and not getattr(
                auth_policy.default_user_role_permissions,
                "allowed_to_create_security_groups",
                True,
            ):
                report.status = "PASS"
                report.status_extended = "Non-privileged users are not able to create security groups via the Access Panel and the Azure administration portal."

            findings.append(report)

        return findings

References