Microsoft Entra tenant where regular users can create Microsoft 365 groups

This issue is rated low severity because an attacker would need additional steps or context to exploit the ability for non-administrative users to create groups. The risk is present but indirect, which places this issue in the lower end of the severity scale.

An attacker might use the ability to create a group to gain access to other user accounts through group membership enumeration. This could allow the attacker to collect sensitive information or even take control of resources within the tenant.

Cayosoft Guardian monitors the settings and permissions in the Entra ID platform to identify when non-administrative users have the ability to create groups. When this is found, Guardian alerts administrators to provide visibility into potential security risks.

Cayosoft Guardian assists response by helping administrators review and limit the ability for non-administrative users to create and manage groups, reducing the potential for attackers to exploit this setting.