1.1.16 Ensure that only organizationally managed/approved public groups exist

Information

Microsoft 365 Groups is the foundational membership service that drives all teamwork across Microsoft 365. With Microsoft 365 Groups, you can give a group of people access to a collection of shared resources. While there are several different types of group types this recommendation is concerned with Microsoft 365 Groups.

In the Administration panel, when a group is created, the default privacy value is 'Public'.

Rationale:

Ensure that only organizationally managed and approved public groups exist. When a group has a 'public' privacy, users may access data related to this group (e.g. SharePoint), through three methods:

By using the Azure portal, and adding themselves into the public group

By requesting access to the group from the Group application of the Access Panel

By accessing the SharePoint URL

Administrators are notified when a user uses the Azure Portal. Requesting access to the group forces users to send a message to the group owner, but they still have immediately access to the group. The SharePoint URL is usually guessable, and can be found from the Group application of the Access Panel. If group privacy is not controlled, any user may access sensitive information, according to the group they try to access.

NOTE: Public in this case meaning public to the identities within organization.

Impact:

If the recommendation is applied, group owners could receive more access requests than usual, especially regarding groups originally meant to be public.

Solution

To enable only organizationally managed/approved public groups exist:

Navigate to Microsoft 365 admin center https://admin.microsoft.com.

Click to expand Teams & groups select Active teams & groups..

On the Active teams and groups page, select the group's name that is public.

On the popup groups name page, Select Settings.

Under Privacy, select Private.

Default Value:

Public when create from the Administration portal; private otherwise.

See Also

https://workbench.cisecurity.org/benchmarks/10751