Back to App

GOV-10: Restrict Security Group Creation

Overview

Security groups are used to grant resource access and to target Conditional Access and other policies. When any user can create them, group sprawl follows: overlapping groups, unclear ownership, and ungoverned access assignments that quietly widen who can reach what. It also weakens least privilege, because access can be granted through groups no one is tracking, and it complicates access reviews when the group inventory is full of noise.

Restricting security group creation to administrators keeps the group inventory governed. New groups enter through people who are accountable for them, which keeps access assignments reviewable and prevents the drift that makes certification difficult.

This control assesses a single tenant setting. The expected state is:

  • Non-admin users cannot create security groups.
  • Security group creation is restricted to administrators.
  • authorizationPolicy.defaultUserRolePermissions.allowedToCreateSecurityGroups is false.

Control ID: GOV-10 Category: Governance & Hygiene Baseline Level: Level 1 (Recommended Secure) Severity: Low License Required: None. Microsoft Entra ID (any tier).

This is a detect-only, advisory control. TrueConfig reads the authorization policy and reports whether allowedToCreateSecurityGroups is false. It does not change the setting for you. The fix is a one-time toggle in the Entra admin center or a single Graph update. This control aligns with CIS Microsoft Entra ID Foundations Benchmark 5.1.3.2.

Note the distinction from Microsoft 365 group creation, which is governed separately under Groups > General. This control specifically covers security group creation via the authorization policy.

Prerequisites

Required Roles

  • Global Administrator - Required to change tenant-wide group settings and the authorization policy

Required Licenses

  • Microsoft Entra ID, any tier

Pre-Configuration Requirements

  1. Identify who legitimately creates security groups today (for example, team leads or delegated department admins) so you can provide a controlled path after locking down.

Time Estimate

TaskDuration
Review the current setting10 minutes
Change the setting5 minutes
Communicate the request path for new groups15-30 minutes

Step-by-Step Instructions

Step 1: Check the Current Setting

Via the Entra admin center

  1. Navigate to the Microsoft Entra admin center (https://entra.microsoft.com).
  2. Go to Identity > Groups > General.
  3. Under Security groups, locate Users can create security groups in Azure portals, API or PowerShell and note its value.

Via Microsoft Graph PowerShell

Connect-MgGraph -Scopes "Policy.Read.All"
(Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions | Select-Object AllowedToCreateSecurityGroups

If AllowedToCreateSecurityGroups returns True, any user can create security groups and this control is flagged.

Step 2: Restrict Security Group Creation

Via the Entra admin center

  1. In Identity > Groups > General, set Users can create security groups in Azure portals, API or PowerShell to No.
  2. Click Save.

Via Microsoft Graph PowerShell

Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"

Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{
    AllowedToCreateSecurityGroups = $false
}

Step 3: Establish a Controlled Group Creation Path

With self-service disabled, provide a governed alternative:

  • Admin-created groups. Users request a security group; an administrator creates it with a proper name, owner, and description.
  • Delegated group creators. Assign the Groups Administrator role to a small set of trusted users who need to create groups, keeping the default blocked for everyone else.

Pair this with a naming convention (see GOV-05) so new groups stay consistent and discoverable.

Step 4: Confirm the Change

Re-run the Graph check from Step 1 and verify AllowedToCreateSecurityGroups now returns False.

Verification Checklist

  • The current value of allowedToCreateSecurityGroups has been reviewed.
  • Users can create security groups is set to No (or allowedToCreateSecurityGroups is false).
  • A controlled path exists for legitimate group creation (admin-created or delegated Groups Administrator role).
  • The request process is documented and communicated.
  • TrueConfig reports GOV-10 as compliant.

Troubleshooting

Issue: A user can still create security groups after the change

Cause: They hold the Groups Administrator role or a higher directory role.

Solution:

  1. Review role assignments for that user.
  2. This is expected if you delegated the Groups Administrator role. If not, remove it.

Issue: An application or script broke because it created groups

Cause: An automation used a standard user account to create security groups.

Solution:

  1. Move the automation to a service principal with the Groups Administrator role, or route creation through an approved process.
  2. Avoid re-enabling tenant-wide self-service to fix a single automation.

Issue: Microsoft 365 groups can still be created by users

Cause: Microsoft 365 group creation is a separate setting from security group creation.

Solution:

  1. This control only covers security groups. Restrict Microsoft 365 group creation separately under Groups > General > Microsoft 365 groups if required.

Cost Considerations

There is no licensing cost. This control uses a built-in setting available on every Microsoft Entra ID tier.

  • Low operational impact. Most users never need to create security groups. Restricting it affects a small number of workflows, which the delegated Groups Administrator role can accommodate.
  • Avoided cost. Uncontrolled group creation drives access sprawl that makes access reviews slower and least privilege harder to maintain. Governing creation reduces that recurring cleanup burden.
  • Detect-only in TrueConfig. TrueConfig monitors the setting continuously and re-flags it if it drifts back to open.

Related Controls

  • GOV-05: Maintain Group Naming Conventions (keep the governed inventory consistent)
  • GOV-09: Restrict Tenant Creation (a related authorization-policy hardening)
  • APP-12: Restrict User App Registration (a related authorization-policy hardening)

Related Resources