Microsoft 365 Group Governance Settings

The question it answers: Who may create Microsoft 365 groups, do names follow a policy, do abandoned groups expire, and what may guests do?

The tenant-wide switches behind Teams and Microsoft 365 group sprawl: who may create groups, whether names follow a policy, whether abandoned groups expire, and what guests may do.

At a glance

Where in the app	Entra ID › Identity Hygiene › M365 Group Governance Settings
Workload	Entra ID
Kind	Findings list · dashboard tile
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	None; group expiration and naming policies only apply with Microsoft Entra ID P1.
Report id (API and MCP)	entra.groups.group-governance-settings

Columns

Column	Key	Type
Severity	Severity	Status
Area	Category	Text
Subject	Subject	Link
Setting	Setting	Text
Current value	Value	Text
Assessment	Finding	Text
Detail	Detail	Text
Date	When	Date
Count	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: None; group expiration and naming policies only apply with Microsoft Entra ID P1.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Directory.Read.All	Microsoft Graph	Read directory data

Data sources it reads

• GET /v1.0/groupSettings
• GET /v1.0/groupLifecyclePolicies

Through the API and MCP

GET /ir-api/v1/reports/entra.groups.group-governance-settings?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.groups.group-governance-settings. The client needs the Read grant for Entra ID. See Using the API.