Microsoft 365 groups should not be publicly visible

A Public group can be read and joined by anyone in your organisation without approval. That includes the mailbox, the shared files and, if the group is behind a team, the team content. Groups made for a sensitive project often start Public by default and stay that way for years.

Microsoft documents the Public and Private options in Manage groups in the Microsoft 365 admin center, and the setting is exposed as the visibility property in the Microsoft Graph group resource.

In the Microsoft 365 admin center open Teams & groups > Active teams & groups, filter to Microsoft 365 groups and read the Privacy column. Any group marked Public is a finding.

Connect-MgGraph -Scopes "Group.Read.All"
Get-MgGroup -All -Filter "groupTypes/any(c:c eq 'Unified')" -Property DisplayName,Visibility,Mail |
  Where-Object { $_.Visibility -eq 'Public' } |
  Select-Object DisplayName,Mail,Visibility

The command only reads. Run it on a test tenant first if you want to see the output shape.

Decide group by group. Some groups, such as an open company-wide community, are meant to be Public. For the rest:

1. Open the group in Active teams & groups and choose Edit privacy, then select Private.
2. Tell the group owners, because people will now need to ask to join.

Connect-MgGraph -Scopes "Group.ReadWrite.All"
# One group at a time; review the list from the check first
Update-MgGroup -GroupId "<group-id>" -Visibility "Private"

ConfigCobra itself is read-only. It reports the Public groups and suggests the fix; you make the change.

Existing members keep their access. New people can no longer join on their own: they send a request that an owner must approve, so owners get extra work. People who are not members cannot read its mail, files or team content. If a group relied on being open for self-service, for example a social or interest group, switch it back or give it a clear owner who answers requests. Items already shared by link are not affected by this setting.