Allow Only Administrators to Manage Security Groups

01 Sign in to Azure Management Console.

02 Navigate to Azure Active Directory blade at https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview.

03 In the navigation panel, select Groups.

04 In the Settings section, select General to access Active Directory user group general settings.

05 On the General settings page, under Security Groups, check Owners who can assign members as group owners in Azure portals setting configuration. If Owners who can assign members as group owners in Azure portals is set to All or Selected (i.e. the list of users selected to manage security groups), there are Active Directory users, including users without administrative privileges, that can manage security groups using the Access Panel and the Azure Admin portal.

06 Repeat steps no. 3 – 5 for each Microsoft Azure Active Directory that you want to examine.

01 Sign in to Azure Management Console.

02 Navigate to Azure Active Directory blade at https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview.

03 In the navigation panel, select Groups.

04 In the Settingssection, select General to access Active Directory user group general settings.

05 On the General settings page, under Security Groups, select None next to Owners who can assign members as group owners in Azure portals configuration setting to disable the non-privileged users' ability to manage security groups using Azure portals.

06 Click Save to apply the changes. If successful, the following message should be displayed: "Successfully updated group settings". Once the configuration changes are saved, only the Active Directory users with an administrator role can manage security groups using the Access Panel and the Azure Admin portal.

07 Repeat steps no. 3 – 6 for each Active Directory (AD) that you want to reconfigure in order to restrict security groups management to AD administrators only.