Azure Compliance ControlsMicrosoft Entra ID
Microsoft Entra ID policies should have 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' set to 'No'
Restrict Microsoft 365 group creation to administrators only. The setting 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' must be set to 'No'. Prowler checks that Microsoft 365 group creation by users is disabled.
What this control checks
'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.15 Access control
- 2 Risk management policy
- 3 Incident handling
- 11 Access control
- 6.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
- 5.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
- 1.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
- 1.20 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
- 2.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_m365_group_creation_disabled - Powerpipe Control:
azure_compliance.control.ad_m365_group_creation_disabled - Prowler Check:
entra_users_cannot_create_microsoft_365_groups
Last reviewed: 2026-10-09