Azure Compliance ControlsMicrosoft Entra ID
Microsoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'
Checks the Microsoft Entra authorization policy setting for default user role permissions on security group creation. The value of `allowed_to_create_security_groups` is examined to determine whether the setting is enabled or disabled for default users.
What this control checks
allowed_to_create_security_groups must be false so only administrators create security groups.
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.2 Information security roles and responsibilities
- A.5.15 Access control
- A.5.18 Access rights
- A.8.2 Privileged access rights
- 2 Risk management policy
- 3 Incident handling
- 11 Access control
- 6.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- 5.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- OIS-02.02B Top management of the cloud service provider has communicated the information security policy to internal and external employees as well as cloud service customers.
- OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.
- 1.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- 1.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- 1.18 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- 2.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- 164.308(a)(4)(ii)(C) Access establishment and modification
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_user_not_allowed_to_create_security_group - Powerpipe Control:
azure_compliance.control.iam_user_not_allowed_to_create_security_group - Prowler Check:
entra_policy_default_users_cannot_create_security_groups
Last reviewed: 2026-10-13