Users Who Can Manage Security Groups

Risk Level: High (not acceptable risk)

Rule ID: ActiveDirectory-018

Ensure that "Owners who can assign members as group owners in Azure portals" is set to "None" in your Microsoft Entra ID settings in order to make sure that non-privileged users are not able to manage security groups via the Access Panel and the Azure Admin portal.

This rule resolution is part of the Conformity Security & Compliance tool for Azure.

Security

Restricting security group management to Microsoft Entra ID administrators only, prohibits users from making changes to security groups. This ensures that security groups are managed solely by designated, authorized users within your Microsoft Entra ID account.

Audit

To determine if non-admin users have the ability to manage security groups in Azure portals, perform the following actions:

Note: Getting "Owners who can assign members as group owners in Azure portals" setting configuration status using Microsoft Graph API or Azure CLI is not currently supported.

Using Azure Console

01 Sign in to Azure Management Console.

02 Navigate to Microsoft Entra ID blade at https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview.

03 In the navigation panel, select Groups.

04 In the Settings section, select General to access Microsoft Entra ID user group general settings.

05 On the General settings page, under Security Groups, check Owners who can assign members as group owners in Azure portals setting configuration. If Owners who can assign members as group owners in Azure portals is set to All or Selected (i.e. the list of users selected to manage security groups), there are Microsoft Entra ID users, including users without administrative privileges, that can manage security groups using the Access Panel and the Azure Admin portal.

06 Repeat steps no. 3 – 5 for each Microsoft Entra ID that you want to examine.

Remediation / Resolution

By setting "Owners who can assign members as group owners in Azure portals" to "None", only Azure Microsoft Entra ID administrators can manage security groups, increasing the level of access security to your Azure cloud resources. To configure the necessary setting, perform the following actions:

Note: Restricting security group management to Microsoft Entra ID administrators only using Microsoft Graph API or Azure CLI is not currently supported.

Using Azure Console

01 Sign in to Azure Management Console.

02 Navigate to Microsoft Entra ID blade at https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview.

03 In the navigation panel, select Groups.

04 In the Settings section, select General to access Microsoft Entra ID user group general settings.

05 On the General settings page, under Security Groups, select None next to Owners who can assign members as group owners in Azure portals configuration setting to disable the non-privileged users' ability to manage security groups using Azure portals.

06 Click Save to apply the changes. If successful, the following message should be displayed: "Successfully updated group settings". Once the configuration changes are saved, only the Microsoft Entra ID users with an administrator role can manage security groups using the Access Panel and the Azure Admin portal.

07 Repeat steps no. 3 – 6 for each Microsoft Entra ID that you want to reconfigure in order to restrict security groups management to Microsoft Entra ID administrators only.

References

Azure Official Documentation
Set up self-service group management in Microsoft Entra ID
CIS Microsoft Azure Foundations

Publication date Aug 30, 2019

Unlock the Remediation Steps

Free 30-day Trial

Automatically audit your configurations with Conformity
and gain access to our cloud security platform.

No thanks, back to article

You are auditing:

Users Who Can Manage Security Groups

Risk Level: High

Audit

Using Azure Console

Remediation / Resolution

Using Azure Console

References

Related ActiveDirectory rules