What this check looks at
Finds Microsoft 365 groups and Teams set to Public, whose conversations and SharePoint files anyone in the organisation can open and search.
Every Microsoft 365 group, and the team built on it, is either Public or Private. In a public group anyone in the organisation can join without approval, read its conversations and open the files in its SharePoint site, and its content turns up in everyone’s search results. In a private group only members can.
The check lists Microsoft 365 groups set to Public, largest first. It fails when more than 20% of groups are public, and warns when there are some but they are 20% or fewer, because a few, such as an all-company or social team, are meant to be open.
Public is an easy choice when someone creates a team in a hurry, and nobody revisits it. HR, finance, board and client teams created as Public leave their files open to every employee. Microsoft 365 Copilot answers from everything the person asking can open, so a question like "what are the salaries in the finance team?" can surface a spreadsheet from a public HR team to anyone with a Copilot licence.
Why it matters
Public is the default when people create a team, so HR, finance and board material often ends up readable by every employee without anyone deciding it should. Microsoft 365 Copilot answers from everything a person can open, so it surfaces those files to anyone who asks the right question.
A typical case: a 90-person firm’s Leadership team was created as Public in 2021. It holds board packs, a redundancy plan and salary review spreadsheets. After Copilot is rolled out, a junior employee asks it to summarise "upcoming changes in the company" and is shown the redundancy list.
Access by staff who should not see personal data is a personal data breach under UK GDPR just as much as access from outside, and in an employment context it can end in grievances and tribunal claims. The fix is simple once the groups are known.
CIS Microsoft 365 Foundations Benchmark 1.2.1 asks that only organisationally managed and approved public groups exist. It supports ISO 27001 A.5.15 and A.8.3 (information access restriction), PCI DSS 7.2.1 and the NCSC Cyber Assessment Framework’s B2.a and B3.a.
How to fix it
Where: Microsoft 365 admin centre → Teams & groups → Active teams & groups
Before you start
- Start with the largest public groups, and check with each owner whether it is meant for the whole company.
Step by step
- List the public groups. In the Microsoft 365 admin centre, go to Teams & groups > Active teams & groups and filter or sort on Privacy. Or in Graph PowerShell, Connect-MgGraph -Scopes Group.Read.All, then Get-MgGroup -Filter "groupTypes/any(c:c eq 'Unified')" -All -Property Id,DisplayName,Visibility | Where-Object Visibility -eq 'Public' | Select-Object DisplayName, Id.
- Agree with owners which should stay public. Start with the largest and those whose names suggest confidential work (HR, finance, board, leadership, client names). Ask each owner whether it is meant for the whole organisation. Keep public only those that are, such as an all-company or social team.
- Make the rest private. In the Microsoft 365 admin centre, go to Teams & groups > Active teams & groups, select the group, open the Settings tab, set Privacy to Private and save. For a team, the owner can also do it in Teams (the team’s More options > Edit team > Privacy), or you can in the Teams admin centre (Teams > Manage teams > select the team > Edit).
- Or change many at once in PowerShell. In Graph PowerShell, Connect-MgGraph -Scopes Group.ReadWrite.All, then run Update-MgGroup -GroupId <group id> -Visibility Private for each group on your list. Exchange Online PowerShell offers the same with Set-UnifiedGroup -Identity <group> -AccessType Private.
- Check the site permissions afterwards. Open each changed team’s SharePoint site, go to Settings > Site permissions and make sure "Everyone except external users" has not been added there directly; if it has, remove it, or the site stays open to everyone.
- Stop new groups defaulting to open. Use sensitivity labels for groups and sites that set privacy (see NL-COL-013) and make a label mandatory when teams are created, so a confidential team cannot be made public by accident. If group creation is not already limited, consider restricting it to a security group of trained people.
- Confirm the change. Rerun the listing from the first step: only the groups you agreed to keep public should remain. The next assessment shows the public share below 20%, with the remaining groups intentionally open.
What users will notice
Members of groups made private are unaffected; others can no longer join or read without being added.
How to confirm it worked
The public group count in the evidence falls, with the remaining public groups intentionally open.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.a Understanding dataB2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | DP-1 Discover, classify and label sensitive dataPA-7 Follow just enough administration (least privilege) |
| Zero Trust | Data |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 7.2.1 An access control model is defined |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.5.15 Access controlA.8.3 Information access restriction |
| CIS M365 | 1.2.1 Ensure that only organisationally managed/approved public groups exist |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Data securityIdentity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Data, privacy and security for Microsoft 365 Copilot (Microsoft Learn)