Back to Checks
azure

Microsoft 365 group creation by users is disabled

entra_users_cannot_create_microsoft_365_groups
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra directory setting Group.Unified governs who can create Microsoft 365 Groups. The evaluation inspects EnableGroupCreation and, when present, GroupCreationAllowedGroupId to determine if group creation is broadly allowed or restricted to a designated group.

Prowler logoProwlerprowler-provider-azure

Risk

Unrestricted group creation drives sprawl of Teams, SharePoint sites, and mailboxes, undermining confidentiality via public spaces and guest invites. Compromised accounts can create groups to stage exfiltration or impersonation. It also heightens integrity risks from unsanctioned owners and operational burden for lifecycle and governance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks entra_users_cannot_create_microsoft_365_groups

Recommendation

Apply least privilege: set EnableGroupCreation=false and allow only a controlled group via GroupCreationAllowedGroupId. Use governed provisioning with naming policies, sensitivity labels, and expiration/owner reviews. Monitor creation events and enforce separation of duties with approvals and lifecycle management.

Remediation

CLI

Update-MgDirectorySetting -DirectorySettingId (Get-MgDirectorySetting | Where-Object {$_.DisplayName -eq 'Group.Unified'}).Id -BodyParameter @{Values = @(@{Name = 'EnableGroupCreation'; Value = 'false'})}

Terraform

data "azuread_directory_setting_template" "unified" {
  display_name = "Group.Unified"
}

resource "azuread_directory_setting" "example_resource_name" {
  template_id = data.azuread_directory_setting_template.unified.id

  values = {
    EnableGroupCreation = "false"
    # Critical: sets EnableGroupCreation to false so users cannot create Microsoft 365 groups
  }
}

Other

1Sign in to the Microsoft Entra admin center
2Go to Groups > General
3Set "Users can create Microsoft 365 groups in Azure portals, API, or PowerShell" to "No"
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.entra.entra_client import entra_client


class entra_users_cannot_create_microsoft_365_groups(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        tenant_id = entra_client.tenant_ids[0]

        for tenant_domain, group_settings in entra_client.group_settings.items():
            group_unified_found = False
            for group_setting in group_settings.values():
                if group_setting.name == "Group.Unified":
                    group_unified_found = True
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=group_setting
                    )
                    report.subscription = f"Tenant: {tenant_domain}"
                    report.status = "FAIL"
                    report.status_extended = "Users can create Microsoft 365 groups."

                    for setting_value in group_setting.settings:
                        if (
                            getattr(setting_value, "name", "") == "EnableGroupCreation"
                            and setting_value.value != "true"
                        ):
                            report.status = "PASS"
                            report.status_extended = (
                                "Users cannot create Microsoft 365 groups."
                            )
                            break

                    findings.append(report)
                    break

            if not group_unified_found:
                report = Check_Report_Azure(metadata=self.metadata(), resource={})
                report.subscription = f"Tenant: {tenant_domain}"
                report.resource_name = tenant_domain
                report.resource_id = tenant_id
                report.status = "FAIL"
                report.status_extended = "Users can create Microsoft 365 groups."
                findings.append(report)

        return findings

References