> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/identity/administration/groups/add.md). # Add Group This page creates a new group in the selected tenant. Complete the shared details, choose a group type, then fill in any additional settings that appear for that type. Selecting **Submit** creates the group immediately, with no confirmation step. ## Group Details These fields apply to every group type. | Field | Description | | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Display Name | The name shown for the group in the Microsoft 365 admin center, address lists, and CIPP. | | Description | A free-text description of the group's purpose. | | Username | The mail nickname for the group, entered without a domain. Combined with the primary domain to form the group's email address for group types that are mail-enabled. | | Primary Domain name | The verified domain used for the group's email address. Only verified domains for the tenant are listed, and the tenant's default domain is selected automatically. | | Owners | One or more users who will be able to manage the group. | | Members | One or more users to add to the group when it is created. | {% hint style="info" %} Security groups and Azure role groups are not mail-enabled, so **Username** and **Primary Domain name** are not used for those types. A random mail nickname is generated instead. Any characters other than letters, numbers, hyphens and underscores are stripped from the username before it becomes the mail nickname. {% endhint %} ## Group Type Select one group type. The type determines which additional settings appear below the selector. | Group Type | Description | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | Azure Role Group | A role-assignable security group, used to assign Entra ID directory roles to a group of users. Role assignability cannot be enabled after creation. | | Security Group | A standard security group, used for granting access to resources and for group-based licensing. | | Microsoft 365 Group | A Microsoft 365 (unified) group with a shared mailbox, calendar, and associated SharePoint site. | | Dynamic Group | A security group whose membership is calculated automatically from a membership rule. | | Distribution List | An Exchange Online distribution group for delivering mail to a static list of recipients. | | Mail Enabled Security Group | A security group that can also receive mail, allowing it to be used both for permissions and for mail delivery. | ## Additional Settings These settings appear only for the group types listed against them. | Setting | Group Types | Description | | --------------------------------------------------------------- | -------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Disable group nesting (prevent other groups from being members) | Azure Role Group, Security Group, Microsoft 365 Group, Dynamic Group | Prevents other groups from being added as members, so the group can only contain users. | | Licenses (optional) | Security Group | Assigns one or more licences to the group, so members inherit them through group-based licensing. Each licence is listed with the number of units currently available. | | Let people outside the organization email the group | Distribution List | Allows senders outside the organisation to email the group. When left off, only authenticated internal senders can deliver to it. | | Email Aliases | Distribution List, Mail Enabled Security Group | Additional email addresses for the group, entered one per line as full SMTP addresses. These are added as secondary addresses alongside the primary address. | | Hide this group from the Global Address List (GAL) | Distribution List, Mail Enabled Security Group | Hides the group from address lists, so it does not appear when users browse or search for recipients. | | Subscribe members to receive group emails | Microsoft 365 Group | Automatically subscribes new members to the group's conversations, so group mail is delivered to their own inbox as well as the group mailbox. | | Dynamic Group Parameters | Dynamic Group | The rule that determines membership, written in Entra ID membership rule syntax. | {% hint style="info" %} An example membership rule for a dynamic group, excluding guests and external users: `(user.userPrincipalName -notContains "#EXT#@") -and (user.userType -ne "Guest")` {% endhint %} {% hint style="warning" %} Members entered on this page are ignored for a **Dynamic Group**, because membership is calculated from the rule rather than assigned directly. Owners are still applied. {% endhint %} {% hint style="warning" %} Group-based licensing requires the tenant to be licensed for Entra ID P1 or higher. Assigning licences through a group without the appropriate licensing is not compliant with Microsoft's licensing terms. {% endhint %} *** ## Feature Requests / Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.cipp.app/user-documentation/identity/administration/groups/add.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.