🛡️ Azure Tenant management group creation does not require authorization🟢⚪

• Contextual name: 🛡️ Tenant management group creation does not require authorization🟢⚪
• ID: /ce/ca/azure/microsoft-entra-id/management-group-creation-authorization
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Description

Open File

Description

A tenant permits management group creation under one of two rules: any user or service principal in the tenant, or only principals granted management group write permission on the root management group. The Require write permissions for creating new management groups setting selects between them. Prerequisites: Grant management group write permission on the root management group to every user and pipeline identity that must continue to create management groups.

Rationale

With the setting off, any user or service principal in the tenant can create a management group under the root or default management group and receives the Owner role on it. A compromised low-privilege account thereby gains a persistent privileged scope in the hierarchy, holding Owner over any subscription later placed in that management group.

Audit

This requirement needs manual assessment. Tenant requireAuthorizationForGroupCreation is not collected.

Remediation

Open File

Remediation

A tenant permits management group creation under one of two rules: any user or service principal in the tenant, or only principals granted management group write permission on the root management group. The Require write permissions for creating new management groups setting selects between them. Prerequisites: Grant management group write permission on the root management group to every user and pipeline identity that must continue to create management groups.

Using an account with Hierarchy Settings Administrator or Owner access on the root management group, open Management groups, select the root group, and open Settings. Enable Require write permissions for creating new management groups. Verify that authorized identities can still create groups and that identities without the required permission cannot.

Automated assessment is unavailable: Tenant requireAuthorizationForGroupCreation is not collected.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 5.9 Ensure creating management groups requires write permission on the root management group (Automated)			1		no data
💼 Cloudaware Framework → 💼 General Access Controls			26		no data