Unable to assign Microsoft Entra ID roles to groups - only seeing users in role assignment interface

Question

I'm experiencing issues with assigning Microsoft Entra ID roles to groups. Here's my situation:

I've logged in as a Global Administrator

I created two groups named:

• "Global Admin" - intended to give members Global Administrator access
• "Global Admin Watcher" - intended to give members Global Administrator Reader access

I have tried creating these groups as both Security groups AND Microsoft 365 groups, but neither type appears in the role assignment interface. When attempting to assign these roles to the groups through the Microsoft Entra admin center, I can only see individual users as options. The groups I created are not appearing at all, regardless of which group type I use.

I'm trying to streamline our administrative access management by assigning roles to groups rather than individual users, but I'm unable to complete this process despite trying different group types.

Based on my research, I may need to create special "role-assignable groups" for Microsoft Entra roles rather than standard security groups or Microsoft 365 groups. Could you please confirm if this is the case and provide guidance on how to properly set up groups that can be assigned Microsoft Entra roles?

Any assistance would be greatly appreciated as this is a critical part of our identity management strategy.

Answer 1

Yes use role-assignable groups.

All the detail starts here:

https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/concept-pim-for-groups

Answer 2

Hello @bharath muppa,

Global admin is one of the admin roles which cannot be assigned directly to groups when a normal group is created, only can be assigned to users individually.

To be able to assign Global admin role to groups in Entra, it is required to create role-assignable groups.

The below option is required to be set to Yes.

Then in the same page below you'll get the option to select role, you can select Global administrator and then click on create.

For more information you may refer document: Role Eligible Groups.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".