Patching hideFromOutlookClients From GraphAPI

Question

So i am writing a flow that creates groups then tries to turn hideFromOutlookClients to true. It says in their settings that it is true when i run

Get-UnifiedGroup -Identity "GroupNameEx" |

Format-List DisplayName,HiddenFromExchangeClientsEnabled

From exhange powershell online. But the patch doesnt actually seem to work. it has only worked when i set it directly in powershell online and not the patch. Ay thoughts?

Answer 1

Send hideFromOutlookClients in a dedicated PATCH request containing no other group properties, and ensure the flow’s access token has Group.ReadWrite.All.

Correct Power Automate request

After the group-creation action completes:

1. Use the group object ID returned by the creation action—not its display name or email address.
2. Add an HTTP request to Microsoft Graph:

PATCH https://graph.microsoft.com/v1.0/groups/{group-id}
Content-Type: application/json

{
  "hideFromOutlookClients": true
}

3. Do not include displayName, description, mailNickname, membership bindings, or any other properties in this PATCH.

Microsoft Graph requires hideFromOutlookClients to be updated in its own PATCH request. The caller must have Group.ReadWrite.All; Directory.ReadWrite.All does not support updating this property.^1^

The property also cannot be set in the initial group-creation POST—it must be applied afterward.^2^

Check authentication and the response

Check the authentication configuration used by the HTTP action rather than assuming it is delegated or application-only:

• The resulting access token must contain Group.ReadWrite.All in the applicable permission claim.
• If consent has not been granted, an administrator might need to grant it.
• Do not rely on Directory.ReadWrite.All for this operation.
• Confirm that the PATCH returns 200 OK. Unlike most group updates, a successful update to hideFromOutlookClients returns 200 OK, not 204 No Content.^1^

If the flow uses a connector or authentication mode that cannot obtain the required permission, change the connection/authentication configuration first. The appropriate choice depends on whether the flow currently authenticates as a user or as an application.

Verify through Graph

Run a GET that explicitly selects the property:

GET https://graph.microsoft.com/v1.0/groups/{group-id}?$select=id,displayName,hideFromOutlookClients

hideFromOutlookClients is not returned in the default group response; it must be requested with $select. A value of true means the group should not be displayed in Outlook clients, including Outlook for Windows and Outlook on the web.^3^

If Graph returns true but Outlook still shows the group

This property is stored in Exchange rather than Microsoft Entra ID’s main group data store.^4^ Therefore:

• Do not verify it through a normal group GET without $select.
• Do not use delta-query output as proof that the update failed; properties stored outside the main data store are not supported in group change tracking.
• Capture the PATCH status, response body, request ID, timestamp, group object ID, and the explicit GET result.

If the dedicated PATCH returns 200 OK and the explicit Graph GET returns true, the Graph update succeeded. If Outlook remains inconsistent after allowing for service synchronization, provide those diagnostics to Microsoft Support. Since setting the value directly in Exchange Online PowerShell already works, repeating that operation is unnecessary for diagnosing the flow.

---

References

1. Update group
2. Create group
3. Add-MgGroupSite
4. Manage groups in Microsoft Graph