Skip to main content

lacework-global-591

1.18 Ensure that 'Restrict user ability to access groups features in the Access Pane' is Set to 'Yes' (Manual)​

Profile Applicability​

• Level 2

Description​

Restricts group creation to administrators with permissions only.

Rationale​

Self-service group management enables users to create and manage security groups or Office 365 groups in Azure Active Directory (Azure AD). Unless a business requires this day-to-day delegation for some users, self-service group management should be disabled.

Impact​

Setting to Yes could create administrative overhead by customers seeking certain group memberships that will have to be manually managed by administrators with appropriate permissions.

Audit​

From Azure Portal​

  1. From Azure Home select the Portal Menu
  2. Select Azure Active Directory
  3. Then Groups
  4. Select General in setting
  5. Ensure that Restrict user ability to access groups features in the Access Pane is set to Yes

Please note that at this point of time, there is no Azure CLI or other API commands available to programmatically conduct security assessment for this recommendation.

Remediation​

From Azure Portal​

  1. From Azure Home select the Portal Menu
  2. SelectAzure Active Directory
  3. Then Groups
  4. Select General in setting
  5. Ensure that Restrict user ability to access groups features in the Access Pane is set to Yes

Please note that at this point of time, there is no Azure CLI or other API commands available to programmatically conduct security configuration for this recommendation.

References​

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-accessmanagement-self-service-group-management
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-privileged-access#pa-1-protect-and-limit-highly-privileged-users
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-privileged-access#pa-5-automate-entitlement-management
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-privileged-access#pa-2-restrict-administrative-access-to-business-critical-systems
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy#gs-2-define-enterprise-segmentation-strategy
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy#gs-6-define-identity-and-privileged-access-strategy