Can a Microsoft Entra Security Group be created using SharePoint CSOM (ClientContext) instead of Microsoft Graph?

Question

I'm developing a SharePoint Online migration tool.

Currently, I create Microsoft Entra Security Groups using Microsoft Graph:
await graphClient.Groups.PostAsync(group);

I would like to know whether the same operation can be performed using SharePoint CSOM (ClientContext) instead of Microsoft Graph.

Specifically:

1. Does SharePoint CSOM provide any API to create a Microsoft Entra (Azure AD) Security Group?
2. If not, is Microsoft Graph the only supported API for creating Microsoft Entra Security Groups?
3. If CSOM cannot create them, is the recommended approach to:
   • Create the Security Group using Microsoft Graph.
     • Add members using Microsoft Graph.
       • Then use CSOM only to assign permissions in SharePoint?

Could someone from Microsoft confirm the supported approach and provide any official documentation?

Answer 1

Hi @Likitha Kattamudi

Based on your description, I understand that you are developing a SharePoint Online migration tool. You want to know if creating Microsoft Entra (Azure AD) Security Groups can be performed using SharePoint CSOM (ClientContext) instead of Microsoft Graph, and what the Microsoft-supported approach is for this scenario.

According to my research, SharePoint CSOM currently does not provide an API to create a Microsoft Entra (Azure AD) Security Group. The SharePoint CSOM documentation is designed to work with SharePoint objects such as: Sites (Webs), Lists, Users, SharePoint Groups, and SharePoint Permissions / Role Assignments.

While CSOM supports operations like adding users to a SharePoint Group or assigning permissions to a principal, there is no documentation describing the creation of a Microsoft Entra Security Group via ClientContext.

There is a CSOM method called Tenant.CreateGroupForSite, but this method is designed to:

• Create a Microsoft 365 Group.
• Attach that group to an existing SharePoint site.

It is not an API to create a standalone Microsoft Entra Security Group. Additionally, Microsoft documentation distinguishes between SharePoint Groups and Security Groups. A SharePoint Group created within SharePoint is only recognized within that specific site collection.

For programmatically creating a Microsoft Entra Security Group, Microsoft Graph is the supported and recommended API by Microsoft.

The API endpoint: POST /groups can be used to create Microsoft 365 Groups and Security Groups.

Microsoft Graph documentation specifies that a Security Group is created with the following attributes: "groupTypes": [],"mailEnabled": false,"securityEnabled": true

Administrators can also create Security Groups through the Microsoft 365 Admin Center (Teams & groups > Active teams and groups > Security groups). However, for migration or automation scenarios, Microsoft Graph is the correct API to use.

Therefore, for a SharePoint Online Migration tool, the recommended approach is:

• Microsoft Graph:
  • Create Microsoft Entra security group
  • Add owners / members
• SharePoint CSOM:
• Ensure the group/principal exists in the SharePoint site if needed
• Add it to a SharePoint group, or
• Assign SharePoint permission levels / role assignments

Please note that Tenant.CreateGroupForSite in SharePoint CSOM is used to create and link a Microsoft 365 Group to an existing SharePoint site, not to create an independent Microsoft Entra Security Group.

Please refer the following document:

Create group
Complete basic operations using SharePoint client library code

Manage groups in Microsoft Graph

I hope this information helps!

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click ""Comment"".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.