> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/entra-id.md).

# Entra ID

Entra ID is where you manage Microsoft Entra ID (formerly Azure AD) **groups** across your clients' tenants — creating them, standardizing them with reusable templates, and rolling a whole set of them out to a tenant (or many tenants) as a baseline. Today the module covers groups only; it doesn't yet manage other Entra ID objects like roles, PIM, or app registrations.

{% hint style="info" %}
Groups you create through Augmentt exist to feed the rest of Secure. A consistent, named set of groups is what makes it possible to scope **Conditional Access**, **Intune**, and **Defender** policies the same way across every client instead of hand-picking membership tenant by tenant.
{% endhint %}

You'll find it at **Secure > Entra ID**, with two views toggled at the top of the page: **Groups** (a single client's actual groups) and **Templates** (reusable group definitions and baselines, viewed across all clients).

## Group types Augmentt manages

Augmentt's Entra ID Groups page works with two Microsoft Entra ID group types:

* **M365** (Microsoft 365 groups) — has a group email address and email domain
* **Security**

{% hint style="info" %}
Mail-enabled security groups and distribution groups are visible in Microsoft Entra ID but aren't created or edited from this page. Distribution lists are managed separately, under **Engage > Distribution Lists**.
{% endhint %}

Every group Augmentt creates uses **Assigned** membership — you pick the owners and members explicitly. Augmentt doesn't create dynamic-membership groups. If a client's tenant already has groups with **dynamic user** or **dynamic device** membership rules (created outside Augmentt, or through a specific security check like the Dynamic Guest Group compliance check), they still show up in the Groups list with their membership type labeled accordingly — you just can't create new ones, or convert a group's membership type, from here.

## Groups: managing one client's groups

Select a client, then go to **Secure > Entra ID > Groups**. The table lists that tenant's M365 and Security groups, with **Group name**, **Type**, **Membership type**, **Members** count, and **Description** — filterable by type and membership type, and grouped by count at the top (**All**, **M365**, **Security**).

Click a group to open it and see its full details across tabs: **Properties**, **Owners**, **Members**, and — for a role-assignable group — **Roles**.

### Add Group(s)

The **Add Group(s)** button gives you three ways to create a group in the selected tenant:

* **Create New** — build a group from scratch (below)
* **From Template** — deploy a saved group template
* **From Baseline** — deploy a saved baseline (a bundle of several group templates at once)

#### Create New

1. Go to **Secure > Entra ID > Groups** and select the client.
2. Click **Add Group(s) > Create New**.
3. On **Group details**, choose the type — **M365** or **Security** — and fill in:
   * **Name** (required)
   * **Group email** (M365 groups only) — a mailbox username plus a domain picked from the tenant's verified domains
   * **Description**
   * **Role assignment** — a toggle that makes this a role-assignable group, so it can later be granted a Microsoft Entra ID directory role. This can't be changed once the group is created.
   * **Owners** and **Members** — picked from the tenant's users (Security groups can also nest another Security group as a member or owner)
   * **Roles** — if role assignment is on, pick which directory roles the group is assigned
4. Click **Next** to review, then **Save**. Augmentt queues the creation as a background task and creates the group in Microsoft Entra ID via the Graph API; you'll see **Group created successfully** once it lands.

{% hint style="warning" %}
Group email and domain can't be changed later once directory roles are assigned to the group — set them correctly at creation time if the group is meant to be role-assignable.
{% endhint %}

#### From Template

1. Go to **Secure > Entra ID > Groups** and select the client.
2. Click **Add Group(s) > From Template**.
3. Pick a **type**, then a **template** of that type — its saved details (owners/members are not carried over, only structural settings) appear below for review, along with when it was last deployed to this tenant.
4. Click **Next**, adjust the **Name** and **Description** if you want something different from the template defaults, then **Next** again.
5. Review and click **Save** to deploy.

#### From Baseline

1. Go to **Secure > Entra ID > Groups** and select the client.
2. Click **Add Group(s) > From Baseline**.
3. Select the **Baseline** to deploy, click **Next**.
4. Review the deployment settings for every group template in the baseline (name, description, and any per-group overrides), click **Next**.
5. Review and click **Deploy Baseline** — every group template in the baseline is created in that tenant in one pass.

### Editing and deleting groups

Selecting **Edit** from a group's row (available only for M365 and Security groups) lets you change its name, description, owners, members, and — for M365 groups without directory roles assigned — its email and domain. Group type, membership type, and role-assignment status can't be changed after creation.

**Delete** removes the group from the tenant. You'll lose your own access to it (if you were a member) as part of the same action, so Augmentt asks you to confirm before deleting.

### Turning existing groups into templates or a baseline

You don't have to start a template from a blank form — you can capture a group you already have. Select one or more groups in the table (the checkboxes), and a footer bar appears with **Create template**. That opens a modal where you can:

* Confirm which selected groups become templates (add or remove from the selection)
* Optionally check **Save groups as a baseline** and give the resulting baseline a name and description, bundling all the selected groups' templates together in one step

## Templates: reusable group definitions and baselines

Switch to the **Templates** toggle (this view isn't scoped to one client — it lists templates and baselines across your whole book of clients) to manage the reusable side of group management.

The table lists both individual **group templates** and **baselines** (a baseline row expands to show every template it bundles), with the same Group type and Membership type columns as the Groups page. Selecting a **Create New** dropdown gives you two options:

* **Template** — capture a single group definition
* **Baseline** — bundle several existing templates into one deployable unit

#### Create a template from a tenant's existing group

1. Go to **Secure > Entra ID > Groups > Templates**.
2. Click **Create New > Template**.
3. Pick a **tenant**, then a **type**, then the specific **group** in that tenant you want to base the template on — its structural settings populate the review section below.
4. Give the template a **name** and **description** (defaulted from the source group, editable).
5. Click **Create**.

Only the group's structural properties are captured (type, security/mail settings, membership rule, role-assignable flag, and — for mail-enabled groups — the mail nickname); owners and members are not part of the template, since those are picked fresh every time the template is deployed to a tenant.

#### Group templates into a baseline

From the Templates view, select one or more template rows and use **Group into baseline** in the footer bar, or click **Create New > Baseline** directly, to open the baseline builder:

1. **Selection** — pick which group templates belong in the baseline.
2. **Deployment settings** — set the baseline's own name/description and review each included template's settings.
3. **Review** — a final look at everything the baseline will create.
4. **Submit** — save the baseline.

A saved baseline can then be deployed to any client from the Groups page's **Add Group(s) > From Baseline** flow described above.

{% hint style="info" %}
Templates and baselines aren't unique to Entra ID Groups — the same **Templates / Baselines** pattern is used throughout Secure (Conditional Access, Intune, Purview retention, and more). If you've built a baseline for one of those, this will feel familiar.
{% endhint %}

## How this actually reaches the tenant

Every create, edit, or delete you trigger from Entra ID > Groups runs as an asynchronous background task, not an instant API call from your browser — Augmentt queues the job, then calls Microsoft Graph against the client's Microsoft 365 tenant (`POST/PATCH/DELETE /groups`, plus the members/owners/directory-roles endpoints) using the same Microsoft 365 integration connection already set up for that client. That connection's consented Graph scopes include `Group.ReadWrite.All`, `GroupMember.ReadWrite.All`, and (for role-assignable groups) directory role scopes — nothing you configure separately just for Groups; if the client's Microsoft 365 integration is connected, Entra ID Groups can use it.

{% hint style="warning" %}
Because deployment is queued, a group you just created or deployed from a template/baseline may take a short moment to appear in the table. Give it a few seconds and refresh if you don't see it right away.
{% endhint %}

## What's out of scope today

This page covers Microsoft Entra ID **group** management only. Based on the current product, Augmentt does not yet manage:

* **Distribution groups** or mail-enabled security groups from this page (distribution lists live under **Engage**)
* **Dynamic membership** group creation (Augmentt-created groups are always Assigned; existing dynamic groups can be viewed but not authored here)
* Other Entra ID objects — **directory roles** themselves (only role *assignment to a group* you create), **PIM**, or **app registrations**

If your workflow needs one of those, it isn't covered by Entra ID Groups yet.

## In this section

* [M365 Groups](/modules/secure/entra-id/m365-groups.md)
* [Security Groups](/modules/secure/entra-id/security-groups.md)

Each page covers that group type's full configuration surface, when to use it over the other type, and posture-check mapping notes.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://helpdesk.augmentt.com/modules/secure/entra-id.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.