📝 Microsoft Entra ID Owners Can Manage Group Membership Requests In The Access Panel is set to Yes 🟢

• Contextual name: 📝 Owners Can Manage Group Membership Requests In The Access Panel is set to Yes 🟢
• ID: /ce/ca/azure/microsoft-entra-id/disable-owners-can-manage-group-membership-requests
• Located in: 📁 Microsoft Entra ID

Flags

• 🟢 Impossible policy
• 🟢 Policy with categories
• 🟢 Policy with type

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Users Who Can Manage Security Groups

Description

Open File

Description

Restrict security group management to administrators only.

Rationale

Restricting security group management to administrators only prohibits users from making changes to security groups. This ensures that security groups are appropriately managed and their management is not delegated to non-administrators.

Impact

Group Membership for user accounts will need to be handled by Admins and cause administrative overhead.

Audit

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Microsoft Entra ID.
3. Under Manage, select Groups.
4. Under Settings, select General.
5. Under Self Service Group Management, ensure that Owners can manage group membership requests in My Groups is set to No.

Default Value

By default, Owners can manage group membership requests in My Groups is set to No.

References

1. https://learn.microsoft.com/en-us/entra/identity/users/groups-self-service-management#making-a-group-available-for-end-user-self-service
2. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-1-separate-and-limit-highly-privilegedadministrative-users

... see more

Remediation

Open File

Remediation

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Microsoft Entra ID.
3. Under Manage, select Groups.
4. Under Settings, select General.
5. Under Self Service Group Management, set Owners can manage group membership requests in My Groups to No.
6. Click Save.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS Azure v2.1.0 → 💼 1.19 Ensure that 'Owners can manage group membership requests in the Access Panel' is set to 'No' - Level 2 (Manual)			1
💼 CIS Azure v3.0.0 → 💼 2.20 Ensure that 'Owners can manage group membership requests in My Groups' is set to 'No' (Manual)			1
💼 Cloudaware Framework → 💼 User Account Management			14