You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Secure external access with groups in Azure Active Directory and Microsoft 365
19
19
20
-
Groups are an essential part of any access control strategy. Azure Active Directory (Azure AD) security groups and Microsoft 365 Groups can be used as the basis for securing access to resources.
21
-
22
-
Groups are the best option to use as the basis for the following access control mechanisms:
20
+
Groups are part of an access control strategy. You can use Azure Active Directory (Azure AD) security groups and Microsoft 365 Groups as the basis for securing access to resources. Use groups for the following access-control mechanisms:
23
21
24
22
* Conditional Access policies
25
-
26
-
* Entitlement Management Access Packages
27
-
23
+
*[What is Conditional Access?](../conditional-access/overview.md)
24
+
* Entitlement management access packages
25
+
*[What is entitlement management?](../governance/entitlement-management-overview.md)
28
26
* Access to Microsoft 365 resources, Microsoft Teams, and SharePoint sites
29
27
30
28
Groups have the following roles:
31
29
32
-
*Owners – Group ownersmanage the group settings and its membership.
33
-
34
-
*Members – Members who inherit the permissions and access assigned to the group.
30
+
***Group owners** – manage group settings and its membership
31
+
***Members** – inherit permissions and access assigned to the group
32
+
***Guests** – are members outside your organization
35
33
36
-
* Guests – Guests are members from outside of your organization.
34
+
## Group strategy
37
35
38
-
## Determine your group strategy
36
+
To develop a group strategy to secure external access to your resources, consider the security posture that you want.
39
37
40
-
As you develop your group strategy to secure external access to your resources, consider [your desired security posture](1-secure-access-posture.md) to determine the following choices.
38
+
Learn more: [Determine your security posture for external access](1-secure-access-posture.md)
41
39
42
-
***Who should be able to create groups?** Do you want only administrators to create groups, or do you want employees and or external users to also create these groups.
40
+
### Group creation
43
41
44
-
**By default any tenant member can create Azure AD security groups*.
42
+
Determine who is granted permissions to create groups: Administrators, employees, and/or external users. Consider the following options:
45
43
46
-
* You can [restrict access to the portal for non-administrators](../develop/howto-restrict-your-app-to-a-set-of-users.md) and disable group creation ability in [PowerShell.](../enterprise-users/groups-troubleshooting.md)
44
+
* Tenant members can create Azure AD security groups
45
+
* Internal and external users can join groups in your tenant
46
+
* Users can create Microsoft 365 Groups
47
+
*[Manage who can create Microsoft 365 Groups](https://learn.microsoft.com/en-us/microsoft-365/solutions/manage-creation-of-groups?view=o365-worldwide)
48
+
* Use Windows PowerShell to configure this setting
49
+
*[Restrict your Azure AD app to a set of users in an Azure AD tenant](../develop/howto-restrict-your-app-to-a-set-of-users.md)
50
+
*[Set up self-service group management in Azure Active Directory](../enterprise-users/groups-self-service-management.md)
51
+
*[Troubleshoot and resolve groups issues](../enterprise-users/groups-troubleshooting.md)
47
52
48
-
* You can also [set up self-service group management in Azure Active Directory](../enterprise-users/groups-self-service-management.md).
53
+
### Invitations to groups
49
54
50
-
**By default all users can create Microsoft 365 Groups and groups are open for all (internal and external) users in your tenant to join*.
51
-
52
-
*[You can restrict Microsoft 365 Group creation](/microsoft-365/solutions/manage-creation-of-groups) to the members of a particular security group. Use Windows PowerShell to configure this setting.
53
-
54
-
***Who should be able to invite people to groups?** Can all group members be able to add other members, or can only group owners add members?
55
-
56
-
***Who can be invited to groups?** By default, external users can be added to groups.
55
+
As part of the group strategy, consider who can invite people, or add them, to groups. Group members can add other members, or group owners can add members. Decide who can be invited. By default, external users can be added to groups.
57
56
58
57
### Assign users to groups
59
58
60
-
Users can be assigned to groups both manually based on the user attributes in their user object, or on other criteria. Users can only be assigned to groups dynamically based on their attributes.
61
-
62
-
For example, you can assign users to groups based on their:
63
-
64
-
* specific job title or department
65
-
66
-
* partner organization to which they belong (manually, or through Connected organizations)
67
-
68
-
* user type (Member or Guest)
69
-
70
-
* participation in a specific project (manually)
71
-
72
-
* location
73
-
74
-
Dynamic groups can contain either users or devices, but not both. You add queries based on user attributes to assign users into the dynamic group. The below example shows queries that add users to the group if they are members (not guests) and in the finance department.
75
-
76
-
77
-
78
-
For more information on dynamic groups, see [Create or update a dynamic group in Azure Active Directory.](../enterprise-users/groups-create-rule.md)
59
+
Users are assigned to groups manually, based on user attributes in their user object, or users are assigned based on other criteria. Users are assigned to groups dynamically based on their attributes. For example, you can assign users to groups based on:
79
60
80
-
### Do not use groups for multiple purposes
61
+
* Job title or department
62
+
* Partner organization to which they belong
63
+
* Manually, or through connected organizations
64
+
* Member or guest user type
65
+
* Participation in a project
66
+
* Manually
67
+
* Location
81
68
82
-
When using groups for security or resource access purposes, it's important that they have a single function. If a group is used to grant access to resources, it shouldn't be used for any other purpose. If a group is used for generic purposes such as to define location or team membership, it shouldn't also be used to secure access.
69
+
Dynamic groups have users or devices, but not both. To assign users to the dynamic group, add queries based on user attributes. The following screenshot has queries that add users to the group if they are finance department members.
83
70
84
-
We recommend a naming convention for security groups that makes the purpose clear. For example:
71
+
85
72
86
-
**Secure_access_finance_apps*
73
+
Learn more: [Create or update a dynamic group in Azure AD](../enterprise-users/groups-create-rule.md)
87
74
88
-
**Team_membership_finance_team*
75
+
### Use groups for one function
89
76
90
-
**Location_finance_building*
77
+
When using groups, it's important they have a single function. If a group is used to grant access to resources, don't use it for another purpose. We recommend a security-group naming convention that makes the purpose clear:
91
78
79
+
* Secure_access_finance_apps
80
+
* Team_membership_finance_team
81
+
* Location_finance_building
92
82
83
+
### Group types
93
84
94
-
### Types of groups
85
+
You can create Azure AD security groups and Microsoft 365 groups in the Azure portal or the Microsoft 365 Admin portal. Use either group type for securing external access.
95
86
96
-
Both Azure AD security groups and Microsoft 365 groups can be created from the Azure AD portal or the Microsoft 365 admin portal. Both types can be used as the basis for securing external access:
97
-
98
-
| Considerations | Azure AD security groups (manual and dynamic)| Microsoft 365 Groups |
87
+
| Considerations |Manual and dynamic Azure AD security groups| Microsoft 365 Groups |
99
88
| - | - | - |
100
-
| What can the group contain?| Users<br>Groups<br>Service principals<br>Devices| Users only |
101
-
| Where is the group created?| Azure AD portal<br>Microsoft 365 portal (if to be mail enabled)<br>PowerShell<br>Microsoft Graph<br>End user portal| Microsoft 365 portal<br>Azure AD portal<br>PowerShell<br>Microsoft Graph<br>In Microsoft 365 applications |
102
-
| Who creates by default?| Administrators <br>Users| Administrators<br>Users |
103
-
| Who can be added by default?| Internal users (tenant members) and guest users | Tenant members and guests from any organization |
104
-
| What does it grant access to?| Only resources to which it's assigned.| All group-related resources:<br>(Group mailbox, site, team, chats, and other included Microsoft 365 resources)<br>Any other resources to which group is added |
105
-
| Can be used with| Conditional Access<br>Entitlement Management<br>Group licensing| Conditional Access<br>Entitlement Management<br>Sensitivity labels |
106
-
107
-
108
-
109
-
Use Microsoft 365 groups to create and manage a set of Microsoft 365 resources, such as a Team and its associated sites and content. They’re a great choice for a project-based effort.
89
+
| The group contains| Users<br>Groups<br>Service principals<br>Devices| Users only |
90
+
| Where the group is created| Azure AD portal<br>Microsoft 365 portal, if mail-enabled)<br>PowerShell<br>Microsoft Graph<br>End user portal| Microsoft 365 portal<br>Azure AD portal<br>PowerShell<br>Microsoft Graph<br>In Microsoft 365 applications |
91
+
| Who creates, by default| Administrators <br>Users| Administrators<br>Users |
92
+
| Who is added, by default| Internal users (tenant members) and guest users | Tenant members and guests from an organization |
93
+
| Access is granted to| Resources to which it's assigned.| Group-related resources:<br>(Group mailbox, site, team, chats, and other Microsoft 365 resources)<br>Other resources to which group is added |
94
+
| Can be used with| Conditional Access<br>entitlement management<br>group licensing| Conditional Access<br>entitlement management<br>sensitivity labels |
110
95
111
-
96
+
> [!NOTE]
97
+
> Use Microsoft 365 groups to create and manage a set of Microsoft 365 resources, such as a Team and its associated sites and content.
112
98
113
99
## Azure AD security groups
114
100
115
-
[Azure AD security groups](./active-directory-manage-groups.md) can contain users or devices and can be used to manage access to
116
-
117
-
* Azure resources such as Microsoft 365 apps, custom apps, and Software as a Service (SaaS) apps such as ServiceNow of Dropbox.
101
+
Azure AD security groups can have users or devices. Use these groups to manage access to:
118
102
119
-
* Azure data and subscriptions.
103
+
* Azure resources
104
+
* Microsoft 365 apps
105
+
* Custom apps
106
+
* Software as a service (SaaS) apps such as Dropbox ServiceNow
107
+
* Azure data and subscriptions
108
+
* Azure services
120
109
121
-
* Azure services.
110
+
Use Azure AD security groups to assign:
122
111
123
-
Azure AD security groups can also be used to:
112
+
* Licenses for services
113
+
* Microsoft 365
114
+
* Dynamics 365
115
+
* Enterprise mobility and security
116
+
* See, [What is group-based licensing in Azure Active Directory?](./active-directory-licensing-whatis-azure-portal.md)
117
+
* Elevated permissions
118
+
* See, [Use Azure AD groups to manage role assignments](../roles/groups-concept.md)
124
119
125
-
* assign licenses for services such as Microsoft 365, Dynamics 365, and Enterprise Mobility and Security. For more information, see [group-based licensing](./active-directory-licensing-whatis-azure-portal.md).
120
+
Learn more:
126
121
127
-
* assign elevated permissions. For more information, see [Use Azure AD groups to manage role assignments](../roles/groups-concept.md).
128
-
129
-
To create a group [in the Azure portal](./active-directory-groups-create-azure-portal.md) navigate to Azure Active Directory, then to Groups. You can also create Azure AD security groups by using [PowerShell cmdlets](../enterprise-users/groups-settings-v2-cmdlets.md).
122
+
*[Manage Azure AD groups and group membership](how-to-manage-groups.md)
123
+
*[Azure AD version 2 cmdlets for group management](../enterprise-users/groups-settings-v2-cmdlets.md).
130
124
131
125
> [!NOTE]
132
-
> A security group can be used for assignment of up to 1500 applications, but not more.
126
+
> Use security groups to assign up to 1,500 applications.
133
127
134
-
128
+
135
129
136
-
> [!IMPORTANT]
137
-
> **To create a mail-enabled security group, go to the [Microsoft 365 Admin center](https://admin.microsoft.com/)**. You cannot create it in the Azure AD portal.
138
-
<br>You must enable a security group for mail at the time of creation. You can’t enable it later.
130
+
### Mail-enabled security group
131
+
132
+
To create a mail-enabled security group, go to the [Microsoft 365 Admin center](https://admin.microsoft.com/). Enable a security group for mail during creation. You can’t enable it later. You can't create the group in the Azure AD portal.
139
133
140
134
### Hybrid organizations and Azure AD security groups
141
135
142
-
Hybrid organizations have both an on-premises infrastructure and an Azure AD cloud infrastructure. Many hybrid organizations that use Active Directory create their security groups on-premises and sync them to the cloud. By using this method, only users in the on-premises environment can be added to the security groups.
136
+
Hybrid organizations have infrastructure for on-premises and an Azure AD. Hybrid organizations that use Active Directory can create security groups on-premises and sync them to the cloud. Therefore, only users in the on-premises environment can be added to the security groups.
143
137
144
-
**Protect your on-premises infrastructure from compromise, as a breach on-premises can be used to gain access to your Microsoft 365 tenant**. See [Protecting Microsoft 365 from on-premises attacks](./protect-m365-from-on-premises-attacks.md) for guidance.
138
+
> [!IMPORTANT]
139
+
> Protect your on-premises infrastructure from compromise. See, [Protecting Microsoft 365 from on-premises attacks](./protect-m365-from-on-premises-attacks.md).
145
140
146
141
## Microsoft 365 Groups
147
142
148
-
[Microsoft 365 Groups](/microsoft-365/admin/create-groups/office-365-groups) are the foundational membership service that drives all access across Microsoft 365. They can be created from the [Azure portal](https://portal.azure.com/), or the [Microsoft 365 portal](https://admin.microsoft.com/). When a Microsoft 365 group is created, you grant access to a group of resources used to collaborate. See [Overview of Microsoft 365 Groups for administrators](/microsoft-365/admin/create-groups/office-365-groups) for a complete listing of these resources.
149
-
150
-
Microsoft 365 Groups have the following nuances for their roles:
151
-
152
-
***Owners** - Group owners can add or remove members and have unique administrative permissions in the group, such as the ability to delete conversations from the shared inbox or change group settings. Group owners can rename the group, update the description or picture and more.
153
-
154
-
***Members** - Group members can access everything in the group but can't change group settings. By default, group members can invite guests to join your group. You can [control that setting](/microsoft-365/admin/create-groups/manage-guest-access-in-groups).
155
-
156
-
***Guests** - Group guests are members who are from outside your organization. Guests by default have some limits to functionality in Teams.
157
-
158
-
143
+
Microsoft 365 Groups is the membership service for access across Microsoft 365. They can be created from the Azure portal, or the Microsoft 365 portal. When you create a Microsoft 365 Group, you grant access to a group of resources for collaboration.
144
+
145
+
Learn more:
146
+
[Overview of Microsoft 365 Groups for administrators](microsoft-365/admin/create-groups/office-365-groups?view=o365-worldwide)
147
+
[Create a group in the Microsoft 365 admin center](/microsoft-365/admin/create-groups/create-groups?view=o365-worldwide)
0 commit comments