Back to Checks
m365

Microsoft 365 group has Private visibility

admincenter_groups_not_public_visibility
Service: admincenterSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft 365 groups are assessed for their visibility setting.

The finding highlights groups configured as Public; groups set to Private align with the intended privacy posture.

Prowler logoProwlerprowler-provider-m365

Risk

Public visibility lets any authenticated tenant user discover and self-join, accessing group files, conversations, SharePoint sites, and calendars.

This weakens confidentiality and can enable unauthorized changes that affect integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks admincenter_groups_not_public_visibility

Recommendation

Set groups to Private by default and allow Public only for clearly non-sensitive communities.

Apply least privilege: restrict who can create or change visibility, require owner approval for membership, review access regularly, and use sensitivity labels to reinforce classification.

Remediation

CLI

Set-UnifiedGroup -Identity <GROUP_NAME_OR_ID> -AccessType Private

Terraform

resource "azuread_group" "<example_resource_name>" {
  display_name     = "<example_resource_name>"
  mail_enabled     = true
  security_enabled = false
  types            = ["Unified"]
  visibility       = "Private" # Critical: sets the group visibility to Private to pass the check
}

Other

1Sign in to https://admin.microsoft.com
2Go to Teams & groups > Active teams & groups
3Select the group with visibility Public
4Open Settings
5Under Privacy, select Private
6Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.admincenter.admincenter_client import (
    admincenter_client,
)


class admincenter_groups_not_public_visibility(Check):
    """Check if groups in Microsoft Admin Center have public visibility.

    This check verifies whether the visibility of groups in Microsoft Admin Center
    is set to 'Private'. If any group has a 'Public' visibility, the check fails.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for groups with public visibility.

        This method iterates through all groups in Microsoft Admin Center and checks
        if any group has 'Public' visibility. If so, the check fails for that group.

        Returns:
            List[CheckReportM365]: A list containing the results of the check for each group.
        """
        findings = []
        for group in admincenter_client.groups.values():
            # Only Microsoft 365 Groups (identified by the "Unified" group type) are in
            # scope for this check per CIS M365 Foundations 1.2.1. Security,
            # Distribution, and other group types are skipped.
            if "Unified" not in group.group_types:
                continue
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=group,
                resource_name=group.name,
                resource_id=group.id,
            )
            report.status = "FAIL"
            report.status_extended = f"Group {group.name} has {group.visibility} visibility and should be Private."

            if group.visibility and group.visibility != "Public":
                report.status = "PASS"
                report.status_extended = (
                    f"Group {group.name} has {group.visibility} visibility."
                )

            findings.append(report)

        return findings

References