Require approval for agent-based Office 365 group membership changes [New in Security Center 7.0]

  • Release version: Australia
  • Updated March 12, 2026
  • 1 minute to read

    • Enable the approval flow for adding or removing Office 365 group members through the Microsoft 365 group membership AI Agent using a system property.

    Use the sn_itsm_aia.office_365_group_member_approval.required system property to control whether the approval flow for adding or removing Office 365 group members through the AI agent is on or off. When the approval workflow is enabled, an approval record must be set to approved by a member of the group specified in the sn_itsm_aia.office_365_group_member_approval.group_id system property. If the sn_itsm_aia.office_365_group_member_approval.group_id property isn't configured, the Microsoft 365 group member approvers group is used.

    More information

    Attribute Description
    Configuration name sn_itsm_aia.office_365_group_member_approval.required
    Configuration type System Properties (/sys_properties_list.do)
    Data type Boolean
    Recommended value true
    Default value true
    Fallback value true
    Category Access control
    Security risk
    • Severity score: 4.9
    • CVSS score: Medium
    • Any user who can access the Microsoft 365 group membership AI Agent can and add and remove Office 365 group members from the Azure AD group if explicit approval from the specified approvers group isn’t required. Ensure that these changes are approved to reduce the risk of elevation of privilege by adding/removing members without proper authorization.
    Functional impact

    When sn_itsm_aia.office_365_group_member_approval.required is set to true, a member of the group specified in sn_itsm_aia.office_365_group_member_approval.<group_id> must approve the Incident requesting addition or removal of Office 365 group members. If sn_itsm_aia.office_365_group_member_approval.required is set to false then no approval is required and the AI Agent can autonomously handle the process of adding or removing members from an Office 365 group.
    Dependencies and prerequisites None

    To learn more about adding or creating a system property, see Add a system property.