After some assistance please We have a security group, well a few, that i need non owners to be able to add members to I have assigned the user the relevent groups admin role, and the add member is still grayed out Am i missing something ? Many thanks

Hi @Danny Kitchen Thank you for posting this in Microsoft Q&A. I understand you trying to add members to a security group, but the "Add member" option is grayed out in Microsoft Entra admin center as like below image. One reason is to lack of permissions. Could confirm which admin role you have assigned to user? In order to create , edit groups into Microsoft Entra admin center user must have one of the following roles: Groups Administrator, User Administrator, Privileged Role Administrator, or Global Administrator Second reason, some groups can't be managed in the Microsoft Entra admin center Groups synced from on-premises Active Directory can be managed only in on-premises Active Directory. Distribution lists and mail-enabled security groups are managed only in Exchange admin center or Microsoft 365 admin center. You must sign in to Exchange admin center or Microsoft 365 admin center to manage these groups. Hope this helps. Do let us know if you any further queries. Thanks, Navya

Entra AD Group, Manage Members Permissions

Accepted answer

Navya 11,225 Reputation points Microsoft Vendor

2024-02-15T11:43:59.89+00:00
Hi @Danny Kitchen

Thank you for posting this in Microsoft Q&A.

I understand you trying to add members to a security group, but the "Add member" option is grayed out in Microsoft Entra admin center as like below image.

One reason is to lack of permissions. Could confirm which admin role you have assigned to user?

In order to create , edit groups into Microsoft Entra admin center user must have one of the following roles: Groups Administrator, User Administrator, Privileged Role Administrator, or Global Administrator

Second reason, some groups can't be managed in the Microsoft Entra admin center

Groups synced from on-premises Active Directory can be managed only in on-premises Active Directory.

Distribution lists and mail-enabled security groups are managed only in Exchange admin center or Microsoft 365 admin center. You must sign in to Exchange admin center or Microsoft 365 admin center to manage these groups.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya
Please sign in to rate this answer.

1 person found this answer helpful.
Danny Kitchen 41 Reputation points

2024-02-15T12:13:46.8966667+00:00

Hi, thanks for reaching out No this is a pure entra group with no hybrid part The user i am testing with has the Groups Administrator role assigned
This is an security group only,

User has this assignment

Navya 11,225 Reputation points Microsoft Vendor

2024-02-15T13:58:04.5766667+00:00

Hi @Danny Kitchen

Thank you for sharing the screenshots. They help me better understand the issue.

As highlighted in the below snippet, the group type is Security and the isAssignableToRole property is set to true. This property is immutable. Once a group is created with this property set, it can't be changed. You can't set the property on an existing group.

Only Global Administrators and Privileged Role Administrators can create a role-assignable group and it requires Microsoft Entra ID P1 or P2 license

In order to add members to the group, you require one of the following roles: Global Administrators or Privileged Role Administrators.

I understand that the add members option is grayed out because the user does not have any of the roles mentioned above.

For your reference: Create a role-assignable group in Microsoft Entra ID

Hope this helps. Do let us know if you any further queries.

Danny Kitchen 41 Reputation points

2024-02-15T14:01:35.96+00:00

Lovely, that explains a lot
Is there a custom group i can make that will provide the required permissions rather than utilising global admin ?

Navya 11,225 Reputation points Microsoft Vendor

2024-02-16T05:34:02.1366667+00:00

Hi @Danny Kitchen

You can create custom roles, but in order to do so, you need a Privileged Role Administrator or Global Administrator and requires a P1 or P2 license.

Reference: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-create

Below are the permissions to create security groups in Microsoft Entra admin center.

The above permissions are currently supported for creating, updating, and deleting security groups, but not for role-assignable groups.

So, as of now to work with role-assignable groups require one of the following roles: Global Administrators or Privileged Role Administrators.

Hope this helps. Do let us know if you any further queries.

Thanks, Navya.

Please remember to "Accept Answer" and "Yes" for was this answer helpful.

Danny Kitchen 41 Reputation points

2024-02-19T08:47:11.29+00:00

Thank you kindly for this assist
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Entra AD Group, Manage Members Permissions

0 additional answers

Your answer