# Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No' .

- Source: https://support.icompaas.com/support/solutions/articles/62000219697-ensure-that-users-can-create-microsoft-365-groups-in-azure-portals-api-or-powershell-is-set-to-no
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [1. Identity and Access Management](https://support.icompaas.com/support/solutions/folders/62000167544)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This setting controls whether regular users can create Microsoft 365 groups. When it is set to No, only administrators can create these groups. This prevents users from creating unnecessary or unauthorized Microsoft 365 groups and helps maintain better control over group creation in the organization.

  

Rationale:

Setting this option to No prevents regular users from creating Microsoft 365 groups without approval. This reduces the chance of unnecessary, duplicate, or insecure groups being created and keeps group creation under administrator control. It improves security and governance.

  

Impact:

This setting improves security and reduces clutter by ensuring that only administrators can create Microsoft 365 groups. It prevents regular users from creating unwanted or unmanaged groups, which helps avoid confusion and reduces the risk of unauthorized access.

  

Default Value:

By default, Microsoft Entra ID allows users to create Microsoft 365 groups. The setting must be changed to No if you want to restrict this.

  

Pre-requisites:

-   You must sign in with a Global Administrator or Privileged Role Administrator account.
    

  

Test Plan:

1.  Go to the Azure portal at [https://portal.azure.com](https://portal.azure.com/).
    
2.  In the portal, search for Microsoft Entra ID.
    
3.  In the left-side menu, under Manage, select Groups.
    
4.  In the Settings section, click General.
    
5.  Scroll to the Microsoft 365 Groups section.
    
6.  Locate the setting where Users can create Microsoft 365 groups in Azure portals, API, or PowerShell.
    
7.  Verify that the setting is set to No.
    

![](https://support.icompaas.com/assets/kb/7e258a80265dbd25.png)

8.  If it is Yes, follow the implementation Plan.
    

Implementation Plan:

1.  Go to the Azure portal at [https://portal.azure.com](https://portal.azure.com/).
    
2.  In the portal, search for Microsoft Entra ID.
    
3.  In the left-side menu, under Manage, select Groups.
    

                                       ![](https://support.icompaas.com/assets/kb/5e21bfe3d22d554e.png)

4.  In the Settings section, click General.
    

                         ![](https://support.icompaas.com/assets/kb/c9e1d27d7a4f7711.png)

5.  Scroll to the Microsoft 365 Groups section.
    
6.  Locate the setting where Users can create Microsoft 365 groups in Azure portals, API, or PowerShell.
    
7.  Set the toggle to No.
    

![](https://support.icompaas.com/assets/kb/a8fa8cae296c1720.png)

8.  Click Save to apply the change.
    

Backout Plan:

1.  Go to the Azure portal at [https://portal.azure.com](https://portal.azure.com/).
    
2.  In the portal, search for Microsoft Entra ID.
    
3.  In the left-side menu, under Manage, select Groups.
    
4.  In the Settings section, click General.
    
5.  Scroll to the Microsoft 365 Groups section.
    
6.  Locate the setting where Users can create Microsoft 365 groups in Azure portals, API, or PowerShell.
    
7.  Set the toggle back to Yes.
    
8.  Click Save to apply the change.
    

Reference:

-   [https://learn.microsoft.com/en-us/entra/identity/users/groups-manage](https://learn.microsoft.com/en-us/entra/identity/users/groups-manage)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.