Microsoft 365
TMA-M365-5.1.3.3
Ensure that 'Owners can manage group membership requests in My Groups' is set to 'No'
Description
Microsoft Entra ID provides self-service group management features that enable users to create and manage their own security groups or Microsoft 365 groups. The owner of the group can approve or deny membership requests and delegate control of group membership. Self-service group management features aren't available for mail-enabled security groups or distribution lists. The recommended state is No. Group owners are standard users who may not have visibility into access governance requirements for a given group. Allowing owners to approve membership requests through My Groups means additions to security groups or Microsoft 365 groups can occur without administrator review, bypassing formal access provisioning controls. Unauthorized or excessive group membership can expand a user's effective permissions and increase the blast radius of a compromised account.
How it is checked
Audit method: Manual review
To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Groups and select General. 3. Verify that Owners can manage group membership requests in My Groups is set to No
How it is fixed
Fix method: Guidance or infrastructure patch
To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Groups select General. 3. Set Owners can manage group membership requests in My Groups to No. 4. Click Save.
Properties
- Operating systems
- Any
- Tags
- m365saas
- Reference
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.1.3.3 Ensure that 'Owners can manage group membership requests in My Groups' is set to 'No'