GruppenverwaltungGroup Management

Sicherheitsgruppen, Microsoft-365-Gruppen, dynamische Regeln, Besitzermodelle und gruppenbasierte Lizenzierung.Security groups, Microsoft 365 groups, dynamic rules, ownership models, and group-based licensing.

GruppentypenGroup types

In Entra ID dominieren Sicherheitsgruppen und Microsoft-365-Gruppen. Beide Objekttypen sind technisch ähnlich, aber funktional unterschiedlich.In Entra ID, security groups and Microsoft 365 groups dominate. Both object types are technically similar but functionally different.

Connect-MgGraph -Scopes "Group.Read.All"
Get-MgGroup -Top 20 -Property DisplayName,SecurityEnabled,MailEnabled,GroupTypes |
  Select-Object DisplayName, SecurityEnabled, MailEnabled, GroupTypes

GET https://graph.microsoft.com/v1.0/groups?$select=displayName,securityEnabled,mailEnabled,groupTypes&$top=20
Authorization: Bearer <token>

Sicherheitsgruppe erstellenCreate security group

Eine klassische Sicherheitsgruppe ist die Standardwahl für Zugriffssteuerung, App-Zuweisungen und rollennahe Automatisierung.A classic security group is the default choice for access control, app assignments, and role-adjacent automation.

Connect-MgGraph -Scopes "Group.ReadWrite.All"
New-MgGroup `
  -DisplayName "SG-Cloud-Admins" `
  -Description "Security group for cloud admins" `
  -MailEnabled:$false `
  -MailNickname "sg-cloud-admins" `
  -SecurityEnabled:$true

POST https://graph.microsoft.com/v1.0/groups
Content-Type: application/json
Authorization: Bearer <token>

{
  "displayName": "SG-Cloud-Admins",
  "description": "Security group for cloud admins",
  "mailEnabled": false,
  "mailNickname": "sg-cloud-admins",
  "securityEnabled": true
}

Microsoft-365-Gruppe erstellenCreate Microsoft 365 group

Microsoft-365-Gruppen bringen Collaboration-Workloads wie SharePoint, Exchange und optional Teams mit. Deshalb sollten Namenskonventionen und Besitzerschaft früh geklärt werden.Microsoft 365 groups bring collaboration workloads such as SharePoint, Exchange, and optionally Teams. Therefore, naming conventions and ownership should be defined early.

Connect-MgGraph -Scopes "Group.ReadWrite.All"
New-MgGroup `
  -DisplayName "M365-Platform-Team" `
  -Description "Collaboration workspace for platform team" `
  -MailEnabled `
  -MailNickname "m365-platform-team" `
  -SecurityEnabled:$false `
  -GroupTypes @("Unified")

POST https://graph.microsoft.com/v1.0/groups
Content-Type: application/json
Authorization: Bearer <token>

{
  "displayName": "M365-Platform-Team",
  "description": "Collaboration workspace for platform team",
  "mailEnabled": true,
  "mailNickname": "m365-platform-team",
  "securityEnabled": false,
  "groupTypes": ["Unified"]
}

Dynamische MitgliedschaftsregelnDynamic membership rules

Dynamische Gruppen basieren auf Benutzer- oder Geräteattributen. Sie eignen sich für Lizenzen, Conditional Access, App-Zuweisungen und Governance – solange die Quellattribute sauber gepflegt und vor Missbrauch geschützt sind.Dynamic groups are based on user or device attributes. They fit licensing, Conditional Access, app assignments, and governance—as long as source attributes are cleanly maintained and protected against misuse.

Connect-MgGraph -Scopes "Group.ReadWrite.All"
New-MgGroup `
  -DisplayName "DG-DE-Users" `
  -Description "Dynamic group for users in Germany" `
  -MailEnabled:$false `
  -MailNickname "dg-de-users" `
  -SecurityEnabled:$true `
  -GroupTypes @("DynamicMembership") `
  -MembershipRule 'user.usageLocation -eq "DE"' `
  -MembershipRuleProcessingState "On"

POST https://graph.microsoft.com/v1.0/groups
Content-Type: application/json
Authorization: Bearer <token>

{
  "displayName": "DG-DE-Users",
  "description": "Dynamic group for users in Germany",
  "mailEnabled": false,
  "mailNickname": "dg-de-users",
  "securityEnabled": true,
  "groupTypes": ["DynamicMembership"],
  "membershipRule": "user.usageLocation -eq \"DE\"",
  "membershipRuleProcessingState": "On"
}

Mitglieder und BesitzerMembers and owners

Mitglieder und Besitzer sollten getrennt betrachtet werden. Besitzer administrieren das Objekt, Mitglieder erhalten Zugriff oder Collaboration-Funktionen.Members and owners should be treated separately. Owners administer the object, while members receive access or collaboration capabilities.

Connect-MgGraph -Scopes "Group.ReadWrite.All","User.Read.All"
New-MgGroupMemberByRef -GroupId "<group-id>" -BodyParameter @{
  "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/<user-id>"
}
New-MgGroupOwnerByRef -GroupId "<group-id>" -BodyParameter @{
  "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/<owner-id>"
}
Remove-MgGroupMemberByRef -GroupId "<group-id>" -DirectoryObjectId "<user-id>"

POST https://graph.microsoft.com/v1.0/groups/<group-id>/members/$ref
POST https://graph.microsoft.com/v1.0/groups/<group-id>/owners/$ref
DELETE https://graph.microsoft.com/v1.0/groups/<group-id>/members/<user-id>/$ref
Authorization: Bearer <token>

Verschachtelte GruppenNested groups

Verschachtelung ist für Sicherheitsgruppen in mehreren Szenarien möglich, aber nicht universell. Besonders bei Microsoft-365-Gruppen und app-spezifischen Assignments gelten Ausnahmen.Nesting is possible for security groups in several scenarios, but not universally. Exceptions especially apply to Microsoft 365 groups and app-specific assignments.

Connect-MgGraph -Scopes "Group.ReadWrite.All"
New-MgGroupMemberByRef -GroupId "<parent-group-id>" -BodyParameter @{
  "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/<child-group-id>"
}

POST https://graph.microsoft.com/v1.0/groups/<parent-group-id>/members/$ref
Content-Type: application/json
Authorization: Bearer <token>

{
  "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/<child-group-id>"
}

Gruppenbasierte LizenzierungGroup-based licensing

Gruppenbasierte Lizenzierung reduziert Sonderfälle und unterstützt JML-Prozesse. Best Practice ist eine klare Trennung nach Persona, Region oder Workload.Group-based licensing reduces exceptions and supports joiner/mover/leaver processes. Best practice is clear separation by persona, region, or workload.

Connect-MgGraph -Scopes "Group.ReadWrite.All","Organization.Read.All"
$sku = Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "ENTERPRISEPACK"
Set-MgGroupLicense -GroupId "<group-id>" -AddLicenses @{SkuId = $sku.SkuId} -RemoveLicenses @()

POST https://graph.microsoft.com/v1.0/groups/<group-id>/assignLicense
Content-Type: application/json
Authorization: Bearer <token>

{
  "addLicenses": [{ "skuId": "6fd2c87f-b296-42f0-b197-1e91e994b900" }],
  "removeLicenses": []
}

AblaufrichtlinieExpiration policy

Eine Ablaufrichtlinie hilft, verwaiste Microsoft-365-Gruppen zu reduzieren. Besitzer erhalten Verlängerungshinweise, bevor ein Objekt abläuft.An expiration policy helps reduce stale Microsoft 365 groups. Owners receive renewal notifications before an object expires.

Connect-MgGraph -Scopes "Group.Read.All"
Get-MgGroup -Filter "groupTypes/any(c:c eq 'Unified')" -ConsistencyLevel eventual

GET https://graph.microsoft.com/v1.0/groups?$filter=groupTypes/any(c:c eq 'Unified')
ConsistencyLevel: eventual
Authorization: Bearer <token>

BenennungsrichtlinieNaming policy

Benennungsrichtlinien strukturieren den Tenant und verhindern Wildwuchs. Präfixe, Suffixe und gesperrte Wörter sind typische Governance-Mittel.Naming policies structure the tenant and prevent sprawl. Prefixes, suffixes, and blocked words are common governance tools.

Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgPolicyDirectorySetting

GET https://graph.microsoft.com/v1.0/policies/directorySettings
Authorization: Bearer <token>

Gruppen auflisten und filternList and filter groups

Für Inventare und Audits sollten Filter nach groupTypes, securityEnabled, mailEnabled oder Namensmustern genutzt werden. Dadurch bleiben Reports performant und reproduzierbar.For inventories and audits, use filters on groupTypes, securityEnabled, mailEnabled, or naming patterns. That keeps reports performant and reproducible.

Connect-MgGraph -Scopes "Group.Read.All"
Get-MgGroup -Filter "securityEnabled eq true" -ConsistencyLevel eventual -CountVariable count -All |
  Select-Object DisplayName, MailEnabled, SecurityEnabled, GroupTypes
$count

GET https://graph.microsoft.com/v1.0/groups?$filter=securityEnabled eq true&$count=true
ConsistencyLevel: eventual
Authorization: Bearer <token>

Dynamic Group Rules – Complete ReferenceDynamic group rules – complete reference

Dynamische Gruppen sind nur so gut wie ihre Quellattribute. Für Level-500-Betrieb müssen HR-Felder, Device Tags, Extension Attributes und Änderungsrechte gemeinsam betrachtet werden – sonst wird eine Automatisierung zur Sicherheitslücke.Dynamic groups are only as good as their source attributes. In level-500 operations, HR fields, device tags, extension attributes, and write permissions must be evaluated together—otherwise automation becomes a security gap.

Operatoren und AusdrückeOperators and expressions

Benutzerattribute für RegelnUser properties for rules

Geräteattribute für RegelnDevice properties for rules

Validierung und typische FehlerValidation and common errors

PraxisbeispieleReal-world examples

Group WritebackGroup writeback

Group Writeback verbindet Cloud-Gruppen mit lokalem Active Directory. Für Hybridorganisationen ist das vor allem relevant, wenn lokale Anwendungen weiterhin AD-Gruppen lesen, während die Quelle der Wahrheit bereits in Entra ID liegt.Group writeback links cloud groups with on-premises Active Directory. In hybrid organizations, this matters when on-premises applications still consume AD groups while Entra ID is already the source of truth.

1. Schreibziel-OU definieren und Berechtigungen des Sync-Dienstkontos prüfen.Define the target OU and validate permissions of the sync service account.
2. Objektnamensschema, Mailattribute und Kollisionen mit bestehenden AD-Gruppen bereinigen.Normalize naming, mail attributes, and collisions with existing AD groups.
3. Writeback aktivieren, Pilotgruppe definieren und Delta/Full Sync dokumentiert testen.Enable writeback, define a pilot set, and test documented delta/full synchronization.
4. Downstream-Apps auf Member- und SID-Auflösung prüfen.Validate downstream applications for member and SID resolution.

Connect-MgGraph -Scopes "Group.Read.All"
Get-MgGroup -Filter "groupTypes/any(c:c eq 'Unified')" -All |
  Select-Object DisplayName, MailNickname, Id

Microsoft 365 Group SettingsMicrosoft 365 group settings

Die Group.Unified-Vorlage steuert Gastzugriff, Benennungsregeln, Klassifizierung und Self-Service. In großen Tenants sollten diese Werte wie eine Richtlinie behandelt und versioniert werden.The Group.Unified template controls guest access, naming, classification, and self-service. In large tenants, treat these values like policy and version them.

BetriebspraktikenOperational practices

Connect-MgGraph -Scopes "Directory.ReadWrite.All","Policy.ReadWrite.Authorization"

$settings = Get-MgBetaDirectorySetting | Where-Object DisplayName -eq "Group.Unified"
if (-not $settings) {
  $template = Get-MgBetaDirectorySettingTemplate | Where-Object DisplayName -eq "Group.Unified"
  $settings = New-MgBetaDirectorySetting -TemplateId $template.Id
}

$values = @(
  @{ Name = "AllowGuestsToAccessGroups"; Value = "true" },
  @{ Name = "AllowToAddGuests"; Value = "false" },
  @{ Name = "UsageGuidelinesUrl"; Value = "https://intra.contoso.com/m365-groups" },
  @{ Name = "ClassificationList"; Value = "Public,Internal,Confidential,HighlyConfidential" },
  @{ Name = "DefaultClassification"; Value = "Internal" },
  @{ Name = "PrefixSuffixNamingRequirement"; Value = "[Department]-[GroupName]" },
  @{ Name = "CustomBlockedWordsList"; Value = "CEO,Admin,Global,Secret,Payroll" }
)

Update-MgBetaDirectorySetting -DirectorySettingId $settings.Id -Values $values