lacework-global-591
Set 'Restrict user ability to access groups features in the Access Pane' to 'Yes' (Manual)
Profile Applicability
• Level 2
Description
Restricts group creation to administrators with permissions only.
Rationale
Self-service group management enables users to create and manage security groups or Office 365 groups in Azure Active Directory (Azure AD). Unless a business requires this day-to-day delegation for some users, self-service group management should be disabled.
Impact
Setting to Yes
could create administrative overhead by customers seeking certain group memberships that will have to be manually managed by administrators with appropriate permissions.
Audit
From Azure Portal
- From Azure Home select the Portal Menu
- Select
Azure Active Directory
- Then
Groups
- Select
General
in setting - Ensure that
Restrict user ability to access groups features in the Access Pane
is set toYes
Please note that at this point of time, there is no Azure CLI or other API commands available to programmatically conduct security assessment for this recommendation.
Remediation
From Azure Portal
- From Azure Home select the Portal Menu.
- Select Azure Active Directory.
- Select Groups.
- Select General under Settings.
- Set Restrict user ability to access groups features in the Access Panel to Yes.
Please note that at this point in time, there is no Azure CLI or other API commands available to programmatically conduct security configuration for this recommendation.
References
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-accessmanagement-self-service-group-management
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-privileged-access#pa-1-protect-and-limit-highly-privileged-users
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-privileged-access#pa-5-automate-entitlement-management
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-privileged-access#pa-2-restrict-administrative-access-to-business-critical-systems
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy#gs-2-define-enterprise-segmentation-strategy
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy#gs-6-define-identity-and-privileged-access-strategy