Rules/GRP-001.no-ownerless-m365-groups.psd1
|
@{ Id = 'GRP-001' Title = 'Every Microsoft 365 group has at least one owner' Area = 'Groups' Severity = 'Low' References = @( 'https://learn.microsoft.com/entra/identity/users/groups-self-service-management' ) Rationale = 'Ownerless Microsoft 365 groups (and their Teams/SharePoint content) have nobody to review membership, guests or lifecycle - access accumulates unmanaged.' Remediation = 'Assign owners to the flagged groups (Entra runs an ownerless-group policy that can ask active members automatically) or retire the groups.' Test = { param($Snapshot) $groupData = $Snapshot.Groups $ownerless = @($groupData.groups | Where-Object { $_._tlIsUnified -and [int]$_._tlOwnerCount -eq 0 }) if ($ownerless.Count -gt 0) { New-TLRuleResult -Status Fail -Evidence @($ownerless | Select-Object -First 15 | ForEach-Object { $_.displayName }) } else { New-TLRuleResult -Status Pass -Evidence ("All {0} Microsoft 365 groups have owners." -f $groupData.summary.unified) } } } |