Home

Introducing the Groups Admin Role

%3CLINGO-SUB%20id%3D%22lingo-sub-978995%22%20slang%3D%22en-US%22%3EIntroducing%20the%20Groups%20Admin%20Role%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-978995%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EToday%2C%20we%20are%20thrilled%20to%20announce%20that%20the%20the%20Groups%20admin%20role%20in%20Azure%20Active%20Directory%20(Azure%20AD)%20is%20now%20generally%20available.%20%26nbsp%3BThis%20new%20Azure%20Active%20Directory%20role%20enables%20you%20to%20perform%20group%20management%20tasks%20for%20and%20Azure%20AD%20security%20groups%20without%20requiring%20Global%20administrator%20permissions.%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3EUsers%20with%20the%20Groups%20administrator%20role%20can%20use%20the%20Microsoft%20365%20Admin%20center%2C%20the%20Azure%20portal%20and%20other%20methods%20to%20create%2C%20edit%2C%20delete%2C%20and%20restore%20groups%2C%20and%20manage%20Office%20365%20Groups%20policies%20(example%20-%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fadmin%2Fcreate-groups%2Fmanage-creation-of-groups%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ecreation%3C%2FA%3E%2C%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fadmin%2Fcreate-groups%2Fgroups-naming-policy%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Enaming%3C%2FA%3E%2C%20and%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-in%2Foffice365%2Fadmin%2Fcreate-groups%2Fplan-for-groups-governance%3Fview%3Do365-worldwide%23group-expiration-policy%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Eexpiration%20policies%3C%2FA%3E%3CSPAN%3E).%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F154695i8EDC055D71D5FBBE%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22clipboard_image_2.png%22%20title%3D%22clipboard_image_2.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EFigure%201%20-%20Managing%20Groups%20in%20the%20Microsoft%20365%20Admin%20center%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F154694i33E64FDA15749501%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22clipboard_image_1.png%22%20title%3D%22clipboard_image_1.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EFigure%202%20-%20Managing%20Groups%20in%20the%20Azure%20portal%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20can%20provision%20the%20Groups%20admin%20role%20using%20Azure%20AD%20PowerShell%3A%3C%2FP%3E%0A%3CP%3E%23Below%20steps%20need%20to%20be%20completed%20only%20once%20to%20install%20the%20Azure%20AD%20scripts%3C%2FP%3E%0A%3CP%3EInstall-Module%20-Name%20AzureAD%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%23Connect%20(use%20privileged%20role)%3C%2FP%3E%0A%3CP%3EConnect-AzureAD%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%23%20Get%20the%20user%20to%20be%20assigned%20the%20role%2C%20replacing%20foo%40contoso.com%20with%20the%20email%20address%20of%20the%20user%3C%2FP%3E%0A%3CP%3E%24roleMember%20%3D%20Get-AzureADUser%20-SearchString%20%22foo%40contoso.com%22%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%23%20Enable%20the%20role%20for%20the%20tenant%20(skip%20this%20step%20if%20you%20have%20already%20enabled%20the%20role%20for%20your%20tenant).%20If%20you%20have%20already%20enabled%20the%20role%2C%20you%20will%20get%20an%20error%20(which%20you%20can%20ignore)%3C%2FP%3E%0A%3CP%3E%24newRole%20%3D%20Enable-AzureADDirectoryRole%20-RoleTemplateId%20%22fdd7a751-b60b-444a-984c-02652fe8fa1c%22%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%23%20Get%20the%20newly%20added%20role%20-%20replace%20the%20role%20template%20Id%20as%20per%20need%3C%2FP%3E%0A%3CP%3E%24newRole%20%3D%20Get-AzureADDirectoryRole%20-Filter%20%22roleTemplateId%20eq%20'fdd7a751-b60b-444a-984c-02652fe8fa1c'%22%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%23%20Add%20the%20user%20to%20this%20role%20-%20copy%20the%20object%20Id%20from%20the%20output%20of%20the%20above%20command%20and%20use%20below%3C%2FP%3E%0A%3CP%3EAdd-%3CSPAN%3EAzureADDirectoryRoleMember%3C%2FSPAN%3E%20-ObjectId%20%24newRole.ObjectId%20-RefObjectId%20%24roleMember.ObjectId%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH1%20id%3D%22toc-hId-2048210620%22%20id%3D%22toc-hId-2048231487%22%3ELimitations%3C%2FH1%3E%0A%3CP%3EThere%20are%20a%20few%20limitations%20that%20we%20are%20looking%20to%20address%20soon%3A%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EThe%20admin%20role%20is%20designed%20mainly%20for%20Office%20365%20groups%20and%20cannot%20manage%20other%20group%20types%20like%20distribution%20groups%2C%20mail-enabled%20security%20groups%20or%20shared%20mailboxes.%3C%2FLI%3E%0A%3CLI%3EThis%20role%20cannot%20be%20used%20to%20update%20a%20Group%E2%80%99s%20email%20address%20or%20modify%20external%20mail%20or%20mail%20delivery%20options%20in%20the%20Microsoft%20365%20admin%20center.%3C%2FLI%3E%0A%3CLI%3EYou%20cannot%20use%20Exchange%20PowerShell%20cmdlets%20to%20manage%20Office%20365%20Groups.%3C%2FLI%3E%0A%3CLI%3EA%20Groups%20admin%20cannot%20manage%20audit%20logs%2C%20access%20reports%2C%20or%20guest%20settings.%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20would%20love%20to%20hear%20your%20feedback%20or%20suggestions.%20Leave%20a%20comment%20here%20or%20reach%20out%20to%20us%20on%20%3CA%20href%3D%22https%3A%2F%2Foffice365.uservoice.com%2Fforums%2F286611-office-365-groups%2Fsuggestions%2F33942997-add-security-groups-to-office-365-groups%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Euser%20voice%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-978995%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EGroups%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%20Groups%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Highlighted
ArunV1
Microsoft

 

Today, we are thrilled to announce that the the Groups admin role in Azure Active Directory (Azure AD) is now generally available.  This new Azure Active Directory role enables you to perform group management tasks for and Azure AD security groups without requiring Global administrator permissions.


Users with the Groups administrator role can use the Microsoft 365 Admin center, the Azure portal and other methods to create, edit, delete, and restore groups, and manage Office 365 Groups policies (example - creation, naming, and expiration policies).

 

clipboard_image_2.png

Figure 1 - Managing Groups in the Microsoft 365 Admin center

 

clipboard_image_1.png

Figure 2 - Managing Groups in the Azure portal

 

You can provision the Groups admin role using Azure AD PowerShell:

#Below steps need to be completed only once to install the Azure AD scripts

Install-Module -Name AzureAD

 

#Connect (use privileged role)

Connect-AzureAD

 

# Get the user to be assigned the role, replacing foo@contoso.com with the email address of the user

$roleMember = Get-AzureADUser -SearchString "foo@contoso.com"

 

# Enable the role for the tenant (skip this step if you have already enabled the role for your tenant). If you have already enabled the role, you will get an error (which you can ignore)

$newRole = Enable-AzureADDirectoryRole -RoleTemplateId "fdd7a751-b60b-444a-984c-02652fe8fa1c"

 

# Get the newly added role - replace the role template Id as per need

$newRole = Get-AzureADDirectoryRole -Filter "roleTemplateId eq 'fdd7a751-b60b-444a-984c-02652fe8fa1c'"

 

# Add the user to this role - copy the object Id from the output of the above command and use below

Add-AzureADDirectoryRoleMember -ObjectId $newRole.ObjectId -RefObjectId $roleMember.ObjectId

 

Limitations

There are a few limitations that we are looking to address soon:

  1. The admin role is designed mainly for Office 365 groups and cannot manage other group types like distribution groups, mail-enabled security groups or shared mailboxes.
  2. This role cannot be used to update a Group’s email address or modify external mail or mail delivery options in the Microsoft 365 admin center.
  3. You cannot use Exchange PowerShell cmdlets to manage Office 365 Groups.
  4. A Groups admin cannot manage audit logs, access reports, or guest settings.

 

We would love to hear your feedback or suggestions. Leave a comment here or reach out to us on user voice.

 

 

 

 

 

 

 

 

 

 

 

 

Related Conversations
Extentions Synchronization
ChirmyRam in Discussions on
3 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
35 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies