How to Create Azure AD Security Group using Microsoft Graph APIs (Postman & Python Code Sample)
Published Dec 07 2022 01:17 AM 9,609 Views

Azure Active Directory (Azure AD) groups are used to manage users that all need the same access and permissions to resources, such as potentially restricted apps and services. Instead of adding special permissions to individual users, you create a group that applies the special permissions to every member of that group.


You can refer to below steps for the scenarios in which you have Azure AD service principle with required permissions to create Security Groups in Azure Active Directory and need to call Microsoft Graph REST APIs from your dev or local environment via Postman or through python code. 


First step is to register client application with Azure AD and assign required permissions to create AD groups


1. Sign in the Azure portal, search for and select Azure Active Directory.

2. In the left panel, under Manage, select App registrations > All Applications > Select your registered application (Service Principal Account) > API Permissions

3. Least Privileged Permissions required to create AAD groups are:

  • Group.Read.All
  • Group.ReadWrite.All
  • Group.Create



Python Source Code:

Refer attached python source code ( 


  1. Update ClientId, ClientSecret and Tenant details in config.cfg fileMayuriBhavsar_0-1670401770382.png
  2. Update Request body to create new group in file 


  3. Install Required dependencies to build the project.


    python3 -m pip install azure-identity
    python3 -m pip install msgraph-core
  4. Ensure that installed package script path are added into System Environment Variables.  



  5. Run file. Choice 6 and 7 are the methods to list or create group using SPN (App Only Authentication)MayuriBhavsar_3-1670402270726.png


    Reference Link:

    Build Python apps with Microsoft Graph - Microsoft Graph | Microsoft Docs

    Step 7: Build Python apps with Microsoft Graph - Microsoft Graph | Microsoft Docs

    Step 8: Build Python apps with Microsoft Graph - Microsoft Graph | Microsoft Docs



Create Authorization Header in Postman Requests Collection Folder Level:

Access Token Url:{{TenantID}}/oauth2/v2.0/token


Grant_Type = Client Credentials




Rest API to create Group:


Request Type: Post

Authorization Type: Bearer Token. Copy the access token created from above step

Request Body:





  "description": "Self help community for sec",
  "displayName": "Library sec",
  "groupTypes": [
  "mailEnabled": true,
  "mailNickname": "sec",
  "securityEnabled": true









Reference Link:

Use Postman with the Microsoft Graph API - Microsoft Graph | Microsoft Docs



  1. If SPN is granted with Delegated permission, you need to follow User Authorization Code to generate access token
  2. If SPN is granted with Application permission, you can follow Grant type= Client Credentials


Version history
Last update:
‎Dec 07 2022 03:14 AM
Updated by: