MT.1064: Ensure that write permissions are required to create new management groups

Not run by Mito today

This check needs a connection to Azure Resource Manager, which Mito’s assessment does not set up. Mito reports it as skipped.

ID	MT.1064
Severity	Medium
Suite	Mito
Product	Azure
Feature	Management groups
Security area	Access control
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:AC-6 Least Privilege
MITRE ATT&CK	T1666
Reads from	Azure Resource Manager

What this checks and how to fix it

By default, all Entra ID security principals can create new management groups. This introduces governance and security risks, as it allows any user to create a new management group and link subscriptions to it without oversight.

To prevent this, Azure provides a setting that enforces write permission requirements for the creation of new management groups. This ensures that only authorized users can manage the structure of your management group hierarchy.

Remediation action

To enable the requirement for write permissions:

1. Navigate to the Microsoft Azure Portal: https://portal.azure.com.
2. In the search bar, type Management groups and open the blade.
3. Select Settings in the left navigation menu.
4. Under Permissions for creating new management groups, enable the switch: Require write permissions for creating new management groups.

Related links

• Organize your resources with management groups

---

Mito check. Author: brianveldman; contributors: l-gosling. Open-source licences.