Back to Checks
m365

Non-admin users cannot create Microsoft 365 groups

entra_policy_default_user_cannot_create_m365_groups
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

The tenant Group.Unified directory setting should have EnableGroupCreation set to false so that non-admin users cannot create Microsoft 365 groups through the portal, API, or PowerShell. Microsoft 365 group creation should be delegated to a controlled set of users.

Prowler logoProwlerprowler-provider-m365

Risk

When any user can create Microsoft 365 groups, they can provision associated resources (SharePoint sites, Teams, mailboxes) without oversight, leading to group sprawl, ungoverned data locations, and a larger attack surface.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_policy_default_user_cannot_create_m365_groups

Recommendation

Disable self-service Microsoft 365 group creation for non-admin users and delegate creation to an approved security group as needed.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Identity** > **Groups** > **General**
3Set **Users can create Microsoft 365 groups in Azure portals, API or PowerShell** to **No**
4Optionally grant creation rights to a specific security group
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client
from prowler.providers.m365.services.entra.entra_service import (
    GROUP_UNIFIED_SETTINGS_TEMPLATE_ID,
)


class entra_policy_default_user_cannot_create_m365_groups(Check):
    """Check if default users are restricted from creating Microsoft 365 groups.

    The Group.Unified directory setting should have EnableGroupCreation set to false
    so that non-admin users cannot create Microsoft 365 groups. If the setting does
    not exist, the tenant uses the default, which allows all users to create groups.

    - PASS: Non-admin users cannot create Microsoft 365 groups.
    - FAIL: Non-admin users are allowed to create Microsoft 365 groups.
    """

    def execute(self) -> List[CheckReportM365]:
        """Evaluate whether default users can create Microsoft 365 groups.

        Inspects the Group.Unified directory setting to determine whether non-admin
        users are allowed to create Microsoft 365 groups. When the setting is absent
        the tenant default (group creation allowed) applies.

        Returns:
            List[CheckReportM365]: A single report indicating whether non-admin users
            are restricted from creating Microsoft 365 groups.
        """
        findings = []
        settings = entra_client.directory_settings.get(
            GROUP_UNIFIED_SETTINGS_TEMPLATE_ID
        )

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=settings or {},
            resource_name="Group.Unified Settings",
            resource_id=GROUP_UNIFIED_SETTINGS_TEMPLATE_ID,
        )
        report.status = "FAIL"
        report.status_extended = (
            "Non-admin users are allowed to create Microsoft 365 groups."
        )

        if settings and str(settings.get("EnableGroupCreation", "")).lower() == "false":
            report.status = "PASS"
            report.status_extended = (
                "Non-admin users are not allowed to create Microsoft 365 groups."
            )

        findings.append(report)
        return findings

References