How to Get Role-assignable Groups in Microsoft 365

Instead of assigning roles to individual users, create a role-assignable group and assign permissions to the group. For example, by assigning the 'Help Desk Admins' role to the 'Help Desk' role-assignable group, you can ensure consistent access for all members, streamline administrative tasks, and simplify auditing.

Creating a role-assignable group in Microsoft 365 through the admin portal involves navigating through multiple tabs and sections, which can be cumbersome. Using PowerShell, admins can streamline this process effectively.

Connect to the Microsoft Graph PowerShell with required permissions using the below cmdlet.

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

Once connected, you can create the desired type of role-assignable group. Below are the steps to create security and Microsoft 365 role-assignable groups.

Security Role-assignable Group

A security role-assignable group is used when you need to assign permissions without the need for collaboration tools. This type of group is ideal for managing access and roles in scenarios where communication features are not required.

Run the below cmdlet in PowerShell to create a security role-assignable group in Microsoft 365.

New-MgGroup -DisplayName "<GroupName>" -MailEnabled:$false -SecurityEnabled -MailNickName "<MailNickName>" -IsAssignableToRole:$true

Microsoft 365 Role-assignable Group

A Microsoft 365 role-assignable group is used when you need to assign roles with integration into collaboration tools such as email and Teams. This type of group is ideal for team-based projects and communication, where both access control and collaboration are necessary.

Execute the following PowerShell cmdlet to create a Microsoft 365 role-assignable group.

New-MgGroup -DisplayName "<GroupName>" -MailEnabled:$true -SecurityEnabled -MailNickName "<MailNickName>" -IsAssignableToRole:$true -GroupTypes "Unified"

Use Microsoft Entra groups to manage role assignments efficiently and reduce manual tasks. By assigning roles to groups rather than individual users, you can centralize access management, making it easy to add or remove users from a role as needed.

Using the Microsoft Entra Admin Center to assign roles can be time-consuming, especially when dealing with multiple groups. In contrast, PowerShell provides a more efficient solution, offering faster execution and greater flexibility in handling role assignments.

Connect to the Microsoft Graph PowerShell with required permission using the below cmdlet.

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

Run the below cmdlet in PowerShell to retrieve the role definition ID of a Microsoft Entra role you wish to assign to a group.

Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq '<RoleName>'"

Execute the following PowerShell cmdlet to assign Microsoft Entra roles to groups.

New-MgRoleManagementDirectoryRoleAssignment -DirectoryScopeId '/' -RoleDefinitionId <RoleDefinitionId> -PrincipalId <GroupId>

Note: You can fetch the Group ID using the 'Get-MgGroup' cmdlet.

To view the role assignments for the group, use the PowerShell cmdlet below.

Get-MgRoleManagementDirectoryRoleAssignment -Filter "PrincipalId eq '<GroupId>'"

Role-assignable groups are secured with specific restrictions to enhance role-based access control in Microsoft Entra ID. These restrictions involve immutability, membership limitations, and specific administrative permissions. They help ensure that only authorized users gain role-based access control in Entra ID, which makes identity management more secure.

Role-assignable groups and Privileged Identity Management (PIM) for groups are both features in Microsoft Entra ID that help manage access to resources, but they serve different purposes.

These groups are designed to streamline the assignment of roles to multiple users. By creating role-assignable groups, admins can assign a role to a group rather than to individual users, simplifying management. Microsoft recommends role-assignable groups not only for role assignments but also for accessing sensitive resources due to extra protections they offer.

PIM for Groups enhances security by providing just-in-time membership and ownership access to groups. It manages highly privileged roles to sensitive resources, allowing temporary role activation within Microsoft Entra groups. It is important to note that any group, whether role-assignable or not (except dynamic membership groups and those synchronized from on-premises) are eligible for PIM for Groups.

In summary, role-assignable groups focus on simplifying role management, while PIM for groups ensures secure and time-bound access to critical roles.

Note: Role-assignable groups require Microsoft Entra ID P1 for creating and assigning roles to groups. Microsoft Entra ID P2 enables Privileged Identity Management (PIM) for just-in-time access to roles.

In Microsoft Entra ID, custom roles allow organizations to manage permissions with precision, ensuring employees only have the access they need. While Microsoft Entra built-in roles provide standard permissions, custom roles enable effective delegation of responsibilities, enhance security, and limit unnecessary access to sensitive data.

Connect to the Microsoft Graph PowerShell with required permissions using the below cmdlet.

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

Run the below PowerShell script to create a custom role in Entra ID.

$displayName = "<RoleName>"
$allowedResourceAction = @("<RolePermission1>", "<RolePermission2>")
$rolePermissions = @(@{AllowedResourceActions= $allowedResourceAction})
New-MgRoleManagementDirectoryRoleDefinition -RolePermissions $rolePermissions -DisplayName $displayName -IsEnabled -TemplateId $templateId

Note: Replace <RoleName>, <RolePermission1>, and <RolePermission2> with the actual role name and permission actions required for your custom role.

Adding custom roles can help tailor permissions to specific needs, but it may become challenging to keep track of who added them and when, especially as the list of custom roles grows. For example, in complex organizations, this is critical for auditing and maintaining control over access levels.

• This report provides a detailed view of all custom roles added, including the role name, the admin who added it, timestamp, extended properties and more.
• Admins can leverage this report to ensure compliance, track changes, and quickly identify any unauthorized or unnecessary roles.