Microsoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'
Checks the Microsoft Entra authorization policy setting for default user role permissions on security group creation. The value of `allowed_to_create_security_groups` is examined to determine whether the setting is enabled or disabled for default users.
Allowing standard users to create security groups drives entitlement sprawl and can grant unauthorized access when those groups are tied to apps, sites, or roles. This weakens least privilege, complicates audits, and enables lateral movement or data exfiltration via misassigned group-based permissions.
What this control checks
allowed_to_create_security_groups must be false so only administrators create security groups.
Audit evidence
Evidence that deployed resources meet this control: Prowler check entra_policy_default_users_cannot_create_security_groups (prowler azure --checks entra_policy_default_users_cannot_create_security_groups); PowerPipe control azure_compliance.control.iam_user_not_allowed_to_create_security_group.
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.5.15 (Access Control), A.5.18 (Access Rights), A.5.2 (Roles and Responsibilities) and 1 more clause.
NIS2 Directive (EU 2022/2555): Mapped to 11.2.2.a (assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;), 11.2.2.d (ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers...), 11.3.2.c (individualise and restrict system administration privileges to the highest extent possible,) and 4 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.2 Information security roles and responsibilities
- A.5.15 Access control
- A.5.18 Access rights
- A.8.2 Privileged access rights
- 2 Risk management policy
- 3 Incident handling
- 11 Access control
- 6.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- 5.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- OIS-02.02B Top management of the cloud service provider has communicated the information security policy to internal and external employees as well as cloud service customers.
- OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.
- 1.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- 1.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- 1.18 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- 2.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'
- 164.308(a)(4)(ii)(C) Access establishment and modification
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_user_not_allowed_to_create_security_group - Powerpipe Control:
azure_compliance.control.iam_user_not_allowed_to_create_security_group - Prowler Check:
entra_policy_default_users_cannot_create_security_groups
Last reviewed: 2026-10-13