> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/entra-id/m365-groups.md). # M365 Groups An M365 group (Microsoft 365 group) is one of the two Entra ID group types Augmentt manages under **Secure > Entra ID**. It's Microsoft's "collaboration" group type — creating one also provisions a shared mailbox, calendar, and (depending on which Microsoft 365 workloads a tenant has enabled) an associated SharePoint site and Teams team. Because of that, an M365 group always carries a group email address. {% hint style="info" %} If you just need a container to scope Conditional Access, Intune, or Defender policy assignment — with no mailbox or collaboration surface attached — use a [Security group](/modules/secure/entra-id/security-groups.md) instead. Reach for an M365 group when the group itself needs to be an email-addressable, collaborative unit (e.g. "Finance Team" gets a shared inbox and Team), not just an access-control bucket. {% endhint %} ## When to use M365 vs. Security | | M365 group | Security group | | ---------------------------------------------------- | --------------------------------------------------------- | -------------------------------------------------- | | Has a mailbox / group email | Yes | No | | Can be nested inside another group as a member/owner | No | Yes (Security groups only) | | Typical use | Collaboration surface (shared mailbox, Teams, SharePoint) | Policy/access scoping (CA, Intune, Defender, RBAC) | | Can be role-assignable | Yes | Yes | ## Configuration surface Everything below is set on **Secure > Entra ID > Groups > Add Group(s) > Create New**, with **M365** selected as the type. * **Name** (required, up to 120 characters) — the group's display name. * **Group email** (required for M365 groups only) — two parts: * a **mailbox username** (the mail nickname) — up to 64 characters, and it can't contain a space or any of `@ ( ) \ [ ] " ; : . < > ,` (Microsoft Graph's mailNickname rules) * a **domain**, picked from a dropdown of the tenant's verified domains only * **Description** (optional, up to 1024 characters). * **Role assignment** — a toggle that makes the group role-assignable, meaning it can later be granted a Microsoft Entra ID directory role. **This can't be changed after the group is created.** Turning it on also forces the group to be created as security-enabled under the hood (Microsoft Graph requires `securityEnabled: true` for any role-assignable group, M365 or Security). * **Owners** — picked from the tenant's users. * **Members** — picked from the tenant's users. (Only Security groups can add another group as a member — M365 groups can only take individual users as owners/members.) * **Roles** — appears only if role assignment is on; pick which Entra ID directory roles the group is assigned. {% hint style="warning" %} Group email and domain can't be changed later once directory roles are assigned to the group — get the mailbox username and domain right at creation time if you intend the group to be role-assignable. {% endhint %} Membership type is always **Assigned** — Augmentt doesn't create M365 groups with dynamic membership rules. (An M365 group's membership type can't be changed after creation either.) ### Editing **Edit** on an M365 group lets you change its name, description, owners, and members. You can also change its **email and domain** — but only if the group has no directory roles assigned yet. Group type, membership type, and role-assignment status are fixed after creation. ### Deleting **Delete** removes the group (and its mailbox/site/Team, per standard Microsoft 365 behavior) from the tenant. If you were a member yourself, you lose your own access as part of the same action — Augmentt asks you to confirm before deleting. ## Templates and baselines M365 group templates work the same way as Security group templates: you capture one from an existing group in a tenant (**Templates > Create New > Template**, pick tenant → M365 type → the specific group), and only the *structural* settings are saved — type, mail-enabled/security-enabled flags, membership rule, the role-assignable flag, and the mail nickname. **Owners and members are never captured into a template** — those are picked fresh every time the template is deployed to a client. M365 templates can be bundled into a **baseline** alongside Security group templates and deployed together to a tenant in one pass. {% hint style="info" %} **Augmentt does not ship any built-in/default M365 group templates.** There's no out-of-the-box "starter" M365 group template in the product — every M365 group template in your library is one you (or another user in your organization) captured from a real group that already exists in a client's tenant. The one adjacent exception worth knowing about: a small number of Augmentt's CIS-benchmark posture templates reference a **dynamic** guest-user security group template as part of a compliance setting — that's a *Security*-group, dynamic-membership template tied to a specific CIS control, not a general-purpose M365 group template, and it isn't something you'd pick from the ordinary Create New > Template flow. See [Security groups](/modules/secure/entra-id/security-groups.md) for that detail. {% endhint %} ## Posture-check / compliance mapping Entra ID Groups (M365 or Security) has **no dedicated posture check of its own** in Augmentt's Secure Score. There's no compliance item that scores "do you have well-formed M365 groups." Where M365 groups matter for posture is indirect: they're mailbox-and-collaboration containers, not access-scoping objects, so they don't show up as the group a Conditional Access, Intune, or Defender policy check requires you to designate. If a posture check in your CIS, NIST, HIPAA, or CMMC assessment needs a group reference (for guest-user dynamic membership, or restricting SharePoint external sharing to a named group, for example), that check is written against a **Security group**, not an M365 group — see the [Security groups](/modules/secure/entra-id/security-groups.md) page for the specifics. In short: build M365 groups for collaboration and mailbox needs; if a posture check or CA/Intune/Defender policy needs a group to scope against, that's almost always a Security group. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/modules/secure/entra-id/m365-groups.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.