Create and manage groups in Microsoft 365

6 minutes

As the previous unit indicated, organizations can use several different portals in Microsoft 365 to organize users into groups. These groups can be used for various purposes, including assigning permissions and managing access to resources. For example, Contoso establishes a security group in the Microsoft 365 admin center that includes all users from the Marketing department. This security group is then granted Full Control access to a dedicated marketing SharePoint site collection.

Organizations should consider the following best practices to ensure they create and manage their groups correctly:

Keep group naming conventions simple but clear.
Create policies and procedures for ongoing group maintenance.
Add users to security groups and then add those security groups to SharePoint default groups or roles rather than adding individual users to the groups or roles.
Maintain a consistent and well-defined account provisioning process.
Assign at least two owners to a group so that one can help out in the other's absence.

To create a group in the Microsoft 365 admin center:

In the Microsoft 365 admin center, in the left-hand navigation pane, select Groups and then select Active groups.
On the Active groups page, select Add a group on the menu bar. Similar to adding a user, this option starts a wizard that walks you through the process of adding a group.
On the Group type page, select the appropriate group type.
On the Set up the basics page, provide a group name and description for the group.

Tip

You must select the Description field to enable the Next button, even if you don't add a description for the group.
On the Assign owners page, select an owner for the group. Select in the Owners field to display the list of all active users, or to speed up the search for a given user, enter the first name of the user to display all users with that first name.
On the Edit settings page, assign a group email address (for mail-enabled groups), identify whether the group is Public or Private, and select whether to create a Microsoft Team for the group.

Tip

The Public group option is selected by default. Even if you want the group to be public, you must still select this option to enable the Next button.
On the Review and finish adding group page, review the information you entered, and if necessary, correct any information that you incorrectly entered. When all information is correct, select the Create group button to add the group.

Important

An organization can't use the Microsoft 365 admin center to edit security groups if it synchronized the groups with its on-premises Active Directory. The organization must use the local Active Directory management tools for this purpose.

You can also use Windows PowerShell to create security groups for Microsoft 365. Within Microsoft Graph PowerShell, you must use the New-MgGroup cmdlet. For example, you would run the following command to create a new security group titled Test Group:

New-MgGroup -DisplayName 'Test Group' -MailEnabled:$False -MailNickName 'testgroup' -SecurityEnabled

Determining group types

You must use the Microsoft 365 admin center to determine the different types of groups used by an organization. When you view groups in the Microsoft 365 admin center, the Type column displays the group type for your reference. You can retrieve the same information using Microsoft Graph PowerShell. You can use the Get-MgGroup cmdlet to display group type information.

Nesting groups

Microsoft 365 enables group nesting, where you can add one group as a member of another group. To nest groups, select the appropriate group instead of a user when adding group members in the Microsoft 365 admin center. You can also use Windows PowerShell to nest security groups.

Warning

Microsoft 365 limits group nesting. You can't add groups of every type as members of all group types.

The following table identifies which group types Microsoft 365 allows as members of other group types.

Group type	Can be a member of Microsoft 365 groups?	Can be a member of Distribution groups?	Can be a member of Security groups?	Can be a member of Mail-enabled Security groups?
Microsoft 365 groups	No	No	No	No
Distribution groups	No	Yes	Yes	Yes
Security groups	No	No	Yes	No
Mail-enabled Security groups	No	Yes	Yes	Yes

Caution

Nested groups can sometimes cause permission issues. As such, it's important to carefully plan your group hierarchy to ensure that you correctly grant permissions.

Deleting and restoring groups

You must perform the following steps to delete a group in the Microsoft 365 admin center:

In the Microsoft 365 admin center, in the left-hand navigation pane, select Groups and then select Active groups.
On the Active groups page, select the group that you want to delete.
On the menu bar, select the ellipsis (More actions) icon and in the drop-down menu that appears, select Delete group.
In the details pane that appears, select Delete group.
Confirm that you want to delete the group.

You can also use Microsoft Graph PowerShell to delete groups by using the Remove-MgGroup cmdlet.

If you delete a Microsoft 365 group, the system retains it for 30 days by default. It treats this 30-day period as a "soft-delete" because you can still restore the group during that time. After 30 days, the system permanently deletes the Microsoft 365 group and its associated contents.

Caution

You can only restore Microsoft 365 groups once you delete them. You can't restore any other group types once you delete them.

When you restore a Microsoft 365 group, the system automatically restores the following content associated with that group:

Microsoft 365 Groups' object, properties, and members in Microsoft Entra ID
Group's e-mail addresses
Exchange Online shared Inbox and calendar
SharePoint Online team site and files
OneNote notebook
Planner
Teams
Yammer group and group content (If you created the Microsoft 365 group from Yammer)
Power BI Classic workspace

Important

Azure Active Directory (Azure AD) is now Microsoft Entra ID. Learn more.

Manage group-based licensing in Microsoft Entra ID

Microsoft paid cloud services, such as Microsoft 365, Enterprise Mobility + Security, Dynamics 365, and other similar products, require licenses. Organizations assign these licenses to each user who needs access to these services. To manage licenses, administrators can use one of the management portals (Microsoft 365 or Microsoft Entra ID) or PowerShell cmdlets. You can manage group-based licensing through the Microsoft 365 admin center or the Microsoft Entra admin center.

Microsoft Entra ID includes group-based licensing, which allows you to assign one or more product licenses to a group. Microsoft Entra ID automatically assigns those licenses to all members added to the group. If any members leave the group, the system automatically removes their licenses. This licensing management eliminates the need for automating license management through PowerShell to reflect changes in the organization and departmental structure on a per-user basis.

Group-based licensing requirements

You must have one of the following licenses for every user who benefits from group-based licensing:

Paid or trial subscription for Microsoft Entra Premium P1 and above.
Paid or trial edition of Microsoft 365 Business Premium or Microsoft 365 Enterprise E3 or Microsoft 365 A3 or Microsoft 365 GCC G3 or Microsoft 365 E3 for GCCH or Microsoft 365 E3 for DOD and above.

For any groups assigned a license, the system requires a license for each unique member. While you don't have to assign each member of the group a license, you must have enough licenses to include all the group members. For example, if you have 1,000 unique members who are part of licensed groups in your tenant, you must have at least 1,000 licenses to meet the licensing agreement.

Group-based licensing features

The following list identifies the main features of group-based licensing:

You can assign licenses to any security group in Microsoft Entra ID. Organizations can sync their on-premises security groups through Microsoft Entra Connect Sync. They can also create security groups directly in Microsoft Entra ID (also called cloud-only groups), or automatically through the Microsoft Entra ID dynamic group feature.
When you assign a product license to a group, the administrator can disable one or more service plans in the product. Administrators typically disable a product service plan when the organization isn't ready to start using a service included in the product. For example, an administrator assigns Microsoft 365 to a department, but temporarily disables the Yammer service.
The system supports all Microsoft cloud services that require user-level licensing. This support includes all Microsoft 365 products, Enterprise Mobility + Security, and Dynamics 365.
Group-based licensing is currently available only through the Microsoft Entra admin center. If you primarily use other management portals for user and group management, such as the Microsoft 365 admin center, you can continue to do so. But you must use the Microsoft Entra admin center to manage licenses at the group level.
Microsoft Entra ID automatically manages license modifications that result from group membership changes. Typically, the system makes license modifications effective within minutes of a membership change.
A user can be a member of multiple groups with license policies specified. A user can also have licenses directly assigned outside of any groups. The resulting user state is a combination of all assigned product and service licenses. When you assign a user account the same license from multiple sources, the system consumes the license only once.
In some cases, you can't assign licenses to a user. For example, an organization doesn't have enough available licenses in the tenant, or it assigned conflicting services at the same time. Administrators can access information about users for whom Microsoft Entra ID couldn't fully process group licenses. They can then take corrective action based on that information.

Knowledge check

Choose the best response for each of the questions below.

Feedback

Was this page helpful?

Create and manage groups in Microsoft 365

Check your knowledge

Feedback