Control: 1.2.1 Ensure that only organizationally managed/approved public groups exist
Description
Microsoft 365 Groups is the foundational membership service that drives all teamwork across Microsoft 365. With Microsoft 365 Groups, you can give a group of people access to a collection of shared resources. While there are several different group types this recommendation concerns Microsoft 365 Groups.
In the Administration panel, when a group is created, the default privacy value is "Public".
Remediation
To remediate using the UI:
- Navigate to
Microsoft 365 admin centerhttps://admin.microsoft.com. - Click to expand
Teams & groupsselectActive teams & groups. - On the Active teams and groups page, select the group's name that is public.
- On the popup groups name page, Select
Settings. - Under Privacy, select
Private.
Default Value
Public when created from the Administration portal; private otherwise.
Usage
Run the control in your terminal:
powerpipe control run microsoft365_compliance.control.cis_v500_1_2_1Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run microsoft365_compliance.control.cis_v500_1_2_1 --shareSQL
This control uses a named query:
select id as resource, case when visibility = 'Public' then 'alarm' else 'ok' end status, case when visibility = 'Public' then title || ' is public.' else title || ' is not public.' end reason , tenant_id as tenant_idfrom azuread_group;