Microsoft Entra ID policies should have 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' set to 'No'
Restrict Microsoft 365 group creation to administrators only. The setting 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' must be set to 'No'. Prowler checks that Microsoft 365 group creation by users is disabled.
Unrestricted group creation drives sprawl of Teams, SharePoint sites, and mailboxes, undermining confidentiality via public spaces and guest invites. Compromised accounts can create groups to stage exfiltration or impersonation. It also heightens integrity risks from unsanctioned owners and operational burden for lifecycle and governance.
What this control checks
'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
Audit evidence
Evidence that deployed resources meet this control: Prowler check entra_users_cannot_create_microsoft_365_groups (prowler azure --checks entra_users_cannot_create_microsoft_365_groups); PowerPipe control azure_compliance.control.ad_m365_group_creation_disabled.
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.5.15 (Access Control).
NIS2 Directive (EU 2022/2555): Mapped to 11.2.2.a (assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;), 11.2.2.d (ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers...), 11.3.2.c (individualise and restrict system administration privileges to the highest extent possible,) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.15 Access control
- 2 Risk management policy
- 3 Incident handling
- 11 Access control
- 6.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
- 5.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
- 1.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
- 1.20 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
- 2.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_m365_group_creation_disabled - Powerpipe Control:
azure_compliance.control.ad_m365_group_creation_disabled - Prowler Check:
entra_users_cannot_create_microsoft_365_groups
Last reviewed: 2026-10-09