Azure AD Group Management (Microsoft Entra ID): A Step-by-Step Guide for Admins

Groups are how you stop managing access one person at a time. Done well, they control application access, licensing, device policy, Conditional Access and Azure permissions from a single place.

This guide teaches Azure AD (Microsoft Entra ID) group management from the ground up. You will learn the group and membership types, who can create and manage groups, how to create assigned and dynamic groups in the portal and with Microsoft Graph PowerShell, how to assign licenses and Azure roles to groups, how hybrid synced groups behave, and the governance and troubleshooting practices that keep a tenant clean as it grows.

Why groups matter

Every identity platform eventually hits the same scaling problem: individual assignments do not scale. Assigning an app, a license or a role to 500 people one by one is slow and error-prone, and nobody remembers to remove access later. Groups solve this by turning access into a membership question.

Group types and membership types

Group types

Membership types

Licensing and limits that matter for dynamic groups

• Dynamic membership requires a Microsoft Entra ID P1 license (or Intune for Education) for each unique user who is a member of one or more dynamic groups. Users do not need the license assigned to them to be members, but you must own enough licenses.
• No license is required for devices in device-based dynamic groups.
• A tenant can have a maximum of 15,000 dynamic membership groups.
• A rule can target users or devices, not both in the same group.
• A newer memberOf operator (listed as preview) lets a dynamic group build its membership from other groups. Only direct members of the source group are included.

Who can create and manage groups

Owners versus members

Members receive the access the group grants. Owners manage the group but do not automatically get the access. Always assign at least two owners so a departing owner does not leave an orphaned group.

Create a group in the Entra admin center

Create an assigned security group

1. Sign in to the Microsoft Entra admin center with Groups Administrator, User Administrator or higher.
2. Go to Entra ID > Groups > All groups and select New group.
3. Choose Group type: Security.
4. Enter a Group name that follows your naming standard (for example SG-Sales-Team) and a clear Description.
5. Leave Microsoft Entra roles can be assigned to the group set to No unless this is a privileged group (see the role-assignable section).
6. Set Membership type: Assigned.
7. Add at least two Owners, then add Members.
8. Select Create.

Create a Microsoft 365 group

Choose Group type: Microsoft 365 instead. You then set a group email address, and the group can back a Team, shared mailbox or SharePoint site. Microsoft 365 groups also expose options such as guest access and, in some tenants, an expiration policy.

Dynamic membership rules

Dynamic groups remove manual membership work. You write a rule, and Entra ID evaluates users or devices against it and adds or removes them automatically.

1. Create a new group and set Membership type to Dynamic User (or Dynamic Device).
2. Select Add dynamic query.
3. Build the rule with the rule builder, or use the Rule syntax editor for advanced expressions.
4. Use Validate Rules (Preview) to test the rule against sample users or devices before saving.
5. Save and create the group, then check the membership after processing completes.

Rule syntax examples

# All members of the Sales department
(user.department -eq "Sales")

# Enabled, internal (non-guest) employees in Pakistan
(user.accountEnabled -eq true) and (user.userType -eq "Member") and (user.country -eq "PK")

# Managers (job title contains "Manager")
(user.jobTitle -contains "Manager")

# All guest users
(user.userType -eq "Guest")

# Users whose UPN starts with "svc-" are excluded from a general group
(user.userPrincipalName -notStartsWith "svc-")

# Corporate-owned Windows devices (Dynamic Device group)
(device.deviceOSType -eq "Windows") and (device.deviceOwnership -eq "Company")

Dynamic group tips

• Rules are not instant. Membership updates after processing, which can take time, especially for large tenants. Do not expect immediate changes.
• Clean data is the foundation. Empty or inconsistent attributes (department, country, job title) produce wrong membership. Fix the source in HR or Active Directory.
• Start with a validation group and review members before attaching licenses or access.
• Keep rules simple and documented in the group description.

Manage members and owners

In the portal

1. Open Entra ID > Groups > All groups and select the group.
2. Choose Members or Owners, then Add or Remove.
3. For many users at once, use Bulk operations (add or remove members, or download the member list) with the provided CSV template.

Nesting groups

A security group can contain other security groups, which lets you build structures such as “All Engineering” containing “Dev” and “QA”. Use nesting carefully:

• Microsoft 365 groups cannot be nested in other groups.
• Role-assignable groups cannot have other groups as active members.
• Group-based licensing applies to direct members, not members of nested groups.
• Deep nesting makes access hard to audit. Keep it to one or two levels.

Assign licenses to groups

Group-based licensing is one of the best uses of groups, because it ties licenses to membership. When someone joins the group, the license is assigned. When they leave, it is removed. It requires Microsoft Entra ID P1.

1. Open the group in the Entra admin center and select Licenses.
2. Choose Assignments, then select the products and the service plans to enable.
3. Save. Entra ID processes the assignment for all current members.
4. Check the group’s Licenses page for any members showing errors.

Use groups for apps, Azure roles and policies

Enterprise applications

In Entra ID > Enterprise apps > your app > Users and groups, assign a group instead of individual users. Combine this with a dynamic group and access follows the user’s attributes. Assigning access to apps through groups requires Microsoft Entra ID P1 or P2.

Azure RBAC

Assign Azure roles to groups rather than individuals, so access reviews and offboarding stay simple.

# Give a group Reader access on a resource group
az role assignment create \
  --assignee-object-id <group-object-id> \
  --assignee-principal-type Group \
  --role "Reader" \
  --scope /subscriptions/<subscription-id>/resourceGroups/rg-prod

Conditional Access and Intune

• Conditional Access: include or exclude groups in policy assignments. Keep an emergency “break-glass” exclusion group and monitor it closely.
• Intune: target configuration profiles, compliance policies and app deployments at user or device groups.

Role-assignable groups and PIM for Groups

If you want to give a group a Microsoft Entra directory role such as Helpdesk Administrator, the group must be a role-assignable group. These carry extra protections because assigning a role to a group is a powerful action.

Privileged Identity Management (PIM) for Groups adds just-in-time membership or ownership to a group, so members are eligible and must activate for a limited time. It is separate from role-assignable groups: a group can be one without the other, though Microsoft recommends role-assignable groups for sensitive access. PIM for Groups requires Microsoft Entra ID P2 or an Entra ID Governance license.

Manage groups with PowerShell and CLI

Old cmdlets and their replacements

Connect and create groups

# Install once (or install only the sub-modules you need)
Install-Module Microsoft.Graph -Scope CurrentUser

# Connect with least-privilege scopes
Connect-MgGraph -Scopes "Group.ReadWrite.All","GroupMember.ReadWrite.All","User.Read.All"

# Create an assigned security group
$group = New-MgGroup -DisplayName "SG-Sales-Team" `
  -Description "Sales team access group" `
  -MailEnabled:$false -MailNickname "sg-sales-team" `
  -SecurityEnabled:$true

# Create a Microsoft 365 group
New-MgGroup -DisplayName "M365-Project-Atlas" `
  -MailEnabled:$true -MailNickname "project-atlas" `
  -SecurityEnabled:$false -GroupTypes @("Unified")

# Create a dynamic security group (rule requires Entra ID P1)
New-MgGroup -DisplayName "DG-Sales-Users" `
  -MailEnabled:$false -MailNickname "dg-sales-users" -SecurityEnabled:$true `
  -GroupTypes @("DynamicMembership") `
  -MembershipRule '(user.department -eq "Sales")' `
  -MembershipRuleProcessingState "On"

Manage members and owners

# Find a group
$group = Get-MgGroup -Filter "displayName eq 'SG-Sales-Team'"

# Add a member
$user = Get-MgUser -UserId "alice@contoso.com"
New-MgGroupMember -GroupId $group.Id -DirectoryObjectId $user.Id

# Remove a member
Remove-MgGroupMemberByRef -GroupId $group.Id -DirectoryObjectId $user.Id

# List members (UPN column)
Get-MgGroupMember -GroupId $group.Id -All |
  ForEach-Object { $_.AdditionalProperties.userPrincipalName }

# Add an owner
New-MgGroupOwnerByRef -GroupId $group.Id -BodyParameter @{
  "@odata.id" = "https://graph.microsoft.com/v1.0/users/$($user.Id)"
}

# Groups a user belongs to
Get-MgUserMemberOf -UserId $user.Id -All |
  ForEach-Object { $_.AdditionalProperties.displayName }

# Change a dynamic rule
Update-MgGroup -GroupId $group.Id -MembershipRule '(user.department -eq "Sales") -and (user.accountEnabled -eq $true)'

# Delete a group
Remove-MgGroup -GroupId $group.Id

Add many users from a CSV

# users.csv has a column named UserPrincipalName
$group = Get-MgGroup -Filter "displayName eq 'SG-Sales-Team'"
Import-Csv .\users.csv | ForEach-Object {
  try {
    $u = Get-MgUser -UserId $_.UserPrincipalName -ErrorAction Stop
    New-MgGroupMember -GroupId $group.Id -DirectoryObjectId $u.Id -ErrorAction Stop
    Write-Host "Added $($_.UserPrincipalName)"
  } catch {
    Write-Warning "Failed: $($_.UserPrincipalName) - $($_.Exception.Message)"
  }
}

Azure CLI alternative

az ad group create --display-name "SG-Sales-Team" --mail-nickname "sg-sales-team"
az ad group member add --group "SG-Sales-Team" --member-id <user-object-id>
az ad group member list --group "SG-Sales-Team" --query "[].userPrincipalName" -o tsv
az ad group delete --group "SG-Sales-Team"

Hybrid: groups synced from Active Directory

Many tenants synchronize on-premises Active Directory groups to Microsoft Entra ID with Microsoft Entra Connect or Cloud Sync. Two rules prevent most confusion:

• The on-premises directory is the source of authority for synced groups. You manage membership in Active Directory, and changes sync to the cloud. You cannot change the membership of a synced group in the Entra admin center.
• Cloud-only groups are managed in the cloud. Use these for cloud-specific access such as Microsoft 365 licensing, Conditional Access or Azure RBAC, so you are not waiting on a sync cycle.

Governance: naming, expiration and access reviews

Groups multiply quickly. Without governance you end up with thousands of unowned, undocumented groups.

Audit group changes

In Entra ID > Monitoring & health > Audit logs, filter by category GroupManagement to see who added or removed members, changed owners or edited a dynamic rule. Send audit logs to Log Analytics or your SIEM and alert on changes to privileged groups.

Troubleshooting

Best practices checklist

• Assign access to groups, never to individuals, wherever the service allows it.
• Use a naming convention that shows purpose and type, for example SG-App-Salesforce-Users, DG-Dept-Finance, M365-Project-Atlas.
• Give every group at least two owners and a description.
• Prefer dynamic groups for attribute-driven membership, but only when the attributes are reliable and not user-editable.
• Use role-assignable groups and PIM for anything that grants privileged roles, and keep membership small.
• Limit who can create groups, and apply naming and expiration policies to Microsoft 365 groups.
• Keep nesting shallow and remember licensing does not follow nested membership.
• Run access reviews on groups that grant sensitive access, and on groups with guests.
• Automate with Microsoft Graph PowerShell and keep scripts in source control with least-privilege scopes.
• Log and alert on membership changes for privileged groups and on dynamic rule edits.
• Clean up regularly: remove empty, ownerless and unused groups.

Cheat sheet

If you manage Active Directory, Azure and Microsoft 365 together, more practical identity and hybrid guides are on VMoreCloud.

Frequently asked questions

Sources and further reading

• Microsoft Learn: Learn about group types, membership types and access management
• Microsoft Learn: Manage rules for dynamic membership groups in Microsoft Entra ID
• Microsoft Learn: Use Microsoft Entra groups to manage role assignments
• Microsoft Learn: Privileged Identity Management for Groups
• Microsoft Learn: Dynamic groups with the memberOf operator (preview)
• Microsoft Learn: Manage Microsoft Entra groups and group membership
• Microsoft Learn: Assign licenses to a group
• Microsoft Learn: Microsoft Graph PowerShell overview
• Microsoft Entra Blog: AzureAD PowerShell retirement
• GitHub: AzureAD to Microsoft Graph migration resources

This guide is based on Microsoft documentation and announcements available on October 28, 2026. Licensing requirements, limits and preview features change often, so confirm details in the Microsoft documentation and your own tenant before making changes. Test group, licensing and role changes in a non-production tenant first.

👤 About the Author

Khurram Shahzad

Hybrid Cloud & Virtualization Engineer

Hybrid Cloud & Virtualization Engineer specializing in VMware (VCF, vSAN, Aria), Microsoft Azure, AWS, Windows Server, Microsoft 365, Entra ID, Intune, Linux, Nutanix, Proxmox, networking, backup & disaster recovery, Cisco and FortiGate. I share practical technical guides, infrastructure projects and insights to help IT professionals build and manage modern IT environments through VMoreCloud.

🖥️ VMware🔷 Azure☁️ AWS🪟 Windows Server🐧 Linux🗄️ Virtualization🛡️ Cybersecurity🔗 Networking💾 Backup & DR✖️ Nutanix🟠 Proxmox

📄

120+

Articles Published

👥

10K+

Readers

🎓

Learning & Sharing

A Stronger Tech Community

View all articles →

“Learn  |  Build  |  Share”

☁️ VMoreCloud|Tech Knowledge for a Better Tomorrow

IT  •  Cloud  •  Virtualization  •  Security  •  Open Source