Rules/GRP-002.no-public-m365-groups.psd1
|
@{ Id = 'GRP-002' Title = 'No Microsoft 365 group is set to Public visibility' Area = 'Groups' Severity = 'Low' References = @( 'https://learn.microsoft.com/microsoft-365/admin/create-groups/compare-groups' ) Rationale = 'Public groups let any member of the organization join and read all content without approval - fine for announcements, wrong for anything with project or HR data.' Remediation = 'Review the flagged groups and switch those carrying non-public content to Private visibility.' Test = { param($Snapshot) $groupData = $Snapshot.Groups $publicGroups = @($groupData.groups | Where-Object { $_._tlIsUnified -and [string]$_.visibility -eq 'Public' }) if ($publicGroups.Count -gt 0) { New-TLRuleResult -Status Fail -Evidence @($publicGroups | Select-Object -First 15 | ForEach-Object { $_.displayName }) } else { New-TLRuleResult -Status Pass -Evidence 'No Microsoft 365 group is public.' } } } |