Manage users in Microsoft Services Hub

The Manage users experience allows you to add users to a workspace, edit user roles and permissions, filter and search for users, and remove users from a workspace, all within the Services Hub. The Manage users page is restricted to Workspace Administrators and users who have "Invite users" permission.

You can manage users:

• Individually
• Through Groups
• Through Microsoft Entra groups

Grant Microsoft Entra group access

Note

Only users with "Invite Users" permission can see the Microsoft Entra group access tab.

The ability to grant Microsoft Entra Directory group access supports all Unified workspaces, and enables you to:

• Grant Microsoft Entra group access within the Services Hub.
• Control Services Hub permissions at a group level.
• Remove Microsoft Entra group access to the Services Hub from within the Services Hub itself.
• Manage individual users from Microsoft Entra groups that require more permissions.

Grant, edit, and remove Microsoft Entra group access

To grant, edit, and remove Microsoft Entra group access, you need to:

• have "Invite users" permission
• have your tenant name ready
• have your object ID ready

Within the Microsoft Entra group access section, you can:

• view the list of Microsoft Entra groups that are granted access in your workspace
• grant access to Microsoft Entra groups
• view and edit group permissions
• check how recently a group was updated
• see how many registered users are in each group

Navigate to the Microsoft Entra group access tab

In the Microsoft Entra group access dashboard, you can view information about Microsoft Entra group permissions, workspace members, Microsoft Entra group names, when they were granted access, and when they were last updated.

1. Sign in to the Services Hub.
2. Click on the Manage users page.
3. Click on the tab labeled Microsoft Entra group access.

You can hover over Permissions for a group to see all of the permissions the group currently has, along with an easy edit link.

The permission options that you can select are:

• Learning
• Invite users
• Health
• View all support cases
• Learning manager
• Customer activity
• Programs
• Shared files

The Microsoft Entra security group feature lets you assign all permissions except for:

• Workspace admin
• Manage users
• Add users to support schedules
• Azure case insights

Note

You cannot grant support contact permissions with a group.

When you grant permissions here, you grant them for an entire Microsoft Entra security group, not an individual user. If you wish to give more permissions to a particular user, you need to click the Users tab, use the search bar there to search for the user, and then grant the additional permissions they need.

Grant Microsoft Entra security group access in the Services Hub

Note

You can grant access to up to 25 Microsoft Entra security groups per workspace. If you have more than 25 Microsoft Entra security groups that need access, you can create nested groups in the Azure portal and register parent groups within the Services Hub. Registered Microsoft Entra security groups can have multiple child groups, and all users under child groups are functionally considered parent group users. No email is sent when granting Microsoft Entra Groups access to the Services Hub. You are responsible for sending an email to your Microsoft Entra group letting the group know they have access to serviceshub.microsoft.com

To grant Microsoft Entra group access:

1. Sign in to the Services Hub.

2. Click on the Manage users page.

3. Click on the tab labeled Microsoft Entra group access.

   

4. Click on the "+ Grant Microsoft Entra group access" button in the upper right of the Microsoft Entra group access tab area.

   

5. In the form that appears, enter your Microsoft Entra group's tenant name and object ID.

6. Select the permissions you want the group's members to have.

7. Click on "Grant access" to finish and save your changes.

   

Note

Each Microsoft Entra group displays a registered user count in the Microsoft Entra group access dashboard. Users can click the Users tab and use the search option within it to search for particular Microsoft Entra group names and view each Microsoft Entra group's current registered users. No email is sent when granting Microsoft Entra Groups access to the Services Hub. You are responsible for sending an email to your Microsoft Entra group letting the group know they have access to serviceshub.microsoft.com

Edit or remove Microsoft Entra group access in the Services Hub

Note

If you delete an Microsoft Entra group from the Services Hub or from Microsoft Entra, its permissions are revoked for all users within that group. The permission changes are then applied for each user of the group the first time they sign in to the Services Hub after you delete the Microsoft Entra security group.

1. Sign in to the Services Hub.

2. Click on the Manage users page.

3. Click on the tab labeled Microsoft Entra group access.

4. Select the Microsoft Entra group in the list that you want to edit.

5. Up at the top of the list, choose one of the two buttons next to the blue "Grant Microsoft Entra group access" button: click "Edit access" if you want to change group permissions, or click "Remove access" if you want to remove the group's access.

   

6. Make your desired changes.

7. Click the submit button to finish and save your changes.

FAQs about granting Microsoft Entra security group access

What workspaces are supported?

All Unified workspaces.

Who can view the list of Microsoft EntraD security groups registered in a workspace?

Anyone with "Invite Users" permissions, CSAMs and backup CSAMs can view registered Microsoft Entra groups in the Services Hub.

Who can grant Microsoft Entra group access?

Anyone with "Invite Users" permissions can grant, edit, and remove Microsoft Entra group access.

How many groups can I register with a workspace?

You can have 25 Microsoft Entra security groups per workspace.

I have more than 25 Microsoft Entra security groups that I need to register in my workspace. What should I do?

You can create nested groups in the Azure portal and register the parent group(s) in the Service hub. Registered Microsoft Entra groups can have multiple child groups, and all users under each child group are considered parent group users.

How should I let users know that an Microsoft Entra group they're in is granted access to the Services Hub?

Whomever is granting Microsoft Entra access is responsible for emailing the users in the Microsoft Entra group when they first grant access to them. The user that changes the permission to the Microsoft Entra group are made, will have to communicate any changes if they feel that is necessary.

How can I invite users from outside my tenant?

You can manually add users from outside your tenant by using the "Add users" link under the Users tab on the Manage users page. For more guidance, see Add individual users.

How does being added to an Microsoft Entra security group change user permissions?

If you add a user who is already registered to a workspace to an Microsoft Entra security group, the next time that user logs in, their individual permissions are combined with their new Microsoft Entra group permissions. The user's permissions are then cumulative, and update in sync with the Microsoft Entra security group permissions any time you modify those.

How do I assign Services Hub Learning to an Microsoft Entra group?

If you have Learning Manager permissions with "invite users" permission, you can assign a course to an Microsoft Entra group from the Learning landing page. See Learning manager specific capabilities to learn more.

I'm a Services Admin, but I can't add Microsoft Entra security groups to my workspace.

You can't add Microsoft Entra security groups to a workspace if you're an MSA, third-party identity user, or guest user.

If the Microsoft Entra service or Azure portal is temporarily down, what happens to Services Hub users?

If a user has signed in to the Services Hub at least once, they can still sign in, but any new Group or user permission changes you’ve made since their last sign-in to won't be reflected until the service is back up.

If a user is completely new and hasn't signed in to the Services Hub before, they can't log in until the service is back up and we can verify their user permissions and roles.

Add individual users

If you have the "Invite users" permission, you can invite other people from your team or organization to your Services Hub workspace.

To add a user, click the blue “Add Users” button in the upper right corner of the table.

Note

If you want to grant access for an Microsoft Entra ID group, see Grant Microsoft Entra group access.

User permissions

There are several user permissions available for the Add user and Edit user experiences:

• Administrator: Promotes the user to a Workspace Administrator. These users can add, remove, and edit users inside a workspace. This includes managing workspace support contacts.
• Base support contact: Promotes the user to a named support contact on the agreement, allowing them to open support cases with Microsoft support engineers.
• Manage users: Provides access to the Manage users page without making the user a Workspace Administrator.
• View all support cases: Provides access to see all workspace specific support cases.
• Learning Manager: Provides the ability to assign learning courses to workspace users and track the progress against those assignments.
• Customer Activity: Directly self-serve on Services Hub to understand what has been purchased and delivered against your current support agreements(s), without needing your CSAM to manually generate your Customer Proof of Delivery (CPOD) report. Learn more: Customer Activity page documentation
• Learning: Provides access to Services Hub Learning.
• Manage Open Canvas: Provides the ability add/edit reporting templates within the Open Canvas experience. Also required to create custom focus areas within the Open Canvas experience.
• View Open Canvas: Provides the rights to view Open Canvas reporting templates within the Open Canvas experience.
• Azure Case Insights: Provides access to the Azure Case Insights experience. Customer must be an Azure ACE customer to get the full experience.
• Programs: Allows access to Programs to build custom plans for the team to learn and grow their skills.
• Invite users: Provides the user with the ability to invite other users to the workspace without being a Workspace Administrator.
• Health: Provides access to the On-Demand Assessments landing page.
• Shared files: Provides access to documents uploaded to the customer as part of their Microsoft Support agreement.

Edit user roles and permissions

To edit user roles and permissions, select the user(s) you wish to edit and then click “Edit User” in the upper right corner of the table.

After the selected edits are made, click "Save" and the dialog box will close.

Filter and search individual users

Note

If you're looking for how to search a Microsoft Entra security group, see Grant Microsoft Entra group access.

You can filter users for status and role and alter the users visible per page. You also can easily search for specific users in your workspace.

Remove a user from a workspace

After selecting the user(s) you wish to remove, click the “Remove users” button from the upper right corner.

Groups

You can also create groups in the Manage Users page. To learn more about groups and sharing, see Groups and sharing.