Back to Checks
m365

Non-admin users cannot create security groups

entra_policy_default_user_cannot_create_security_groups
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra tenant's authorization policy should restrict non-admin users from creating security groups. Security groups can be used to grant access to resources across Microsoft 365, so their creation should be limited to administrators to preserve least privilege and prevent uncontrolled access grants.

Prowler logoProwlerprowler-provider-m365

Risk

When any user can create security groups, they may grant themselves or others access to resources, circumventing governance controls. Uncontrolled group sprawl also complicates access reviews and increases the attack surface for privilege escalation.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_policy_default_user_cannot_create_security_groups

Recommendation

Restrict security group creation to administrators by disabling self-service security group creation for non-admin users. Grant group-creation rights only to specific roles or delegated owners as required.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Identity** > **Groups** > **All groups** > **General**
3Under **Security groups**, set **Users can create security groups in Azure portals, API or PowerShell** to **No**
4Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client


class entra_policy_default_user_cannot_create_security_groups(Check):
    """Check if default users are restricted from creating security groups.

    This check verifies whether the authorization policy prevents non-admin users
    from creating security groups in Microsoft Entra ID.

    - PASS: Non-admin users cannot create security groups.
    - FAIL: Non-admin users are allowed to create security groups.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for security group creation restrictions.

        This method examines the authorization policy settings to determine if
        non-admin users are allowed to create security groups. If security group
        creation is restricted, the check passes.

        Returns:
            List[CheckReportM365]: A list containing the result of the check.
        """
        findings = []
        auth_policy = entra_client.authorization_policy

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=auth_policy if auth_policy else {},
            resource_name=auth_policy.name if auth_policy else "Authorization Policy",
            resource_id=auth_policy.id if auth_policy else "authorizationPolicy",
        )
        report.status = "FAIL"
        report.status_extended = (
            "Non-admin users are allowed to create security groups."
        )

        permissions = getattr(auth_policy, "default_user_role_permissions", None)
        if permissions and permissions.allowed_to_create_security_groups is False:
            report.status = "PASS"
            report.status_extended = (
                "Non-admin users are not allowed to create security groups."
            )

        findings.append(report)
        return findings

References