Restrict member users' default permissions - looking for clarification

Question

When looking at the Microsoft documentation on user default permission I brought up to my team that the settings we have look to be a security concern, below is a screenshot of our settings:

In your experience when changing the settings marked with a red rectangle, what are the usual business impacts of doing so? I am having pushback from our department, and I would like some help showing my team that making these changes is a net positive for security and will not harm our user experience.

Thank you.

Answer 1

@Zach Gonzales IS, Thanks for posting in Q&A. Based on the Microsoft documentation, changing the settings marked with a red rectangle in the screenshot provided could have the following business impacts:

• Setting "Register applications" to "No" would prevent users from creating application registrations. However, this ability can be granted back to specific individuals by adding them to the application developer role.
• Setting "Create security groups" to "No" would prevent users from creating security groups. However, global administrators and user administrators can still create security groups.
• "Guest user access is restricted to properties and memberships of their own directory objects" restricts guest access to only their own user profile by default. Access to other users is no longer allowed, even when they're searching by user principal name, object ID, or display name. Access to group information, including groups memberships, is also no longer allowed.

To address pushback from your department, you can explain that these changes are a net positive for security as they restrict users' default permissions and prevent them from taking actions that could potentially harm the organization. However, it's important to carefully consider the specific needs and workflows of your organization before making any changes to default permissions.

---

References:

• What are the default user permissions in Azure Active Directory? - Restrict member users' default permissions
• What are the default user permissions in Azure Active Directory? - Restrict guest users' default permissions

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.