{"id":480,"date":"2025-05-05T19:48:56","date_gmt":"2025-05-05T17:48:56","guid":{"rendered":"https:\/\/www.busted.dk\/blog\/?p=480"},"modified":"2025-05-06T22:05:13","modified_gmt":"2025-05-06T20:05:13","slug":"enable-security-group-functionality-on-a-microsoft-365-group","status":"publish","type":"post","link":"https:\/\/www.busted.dk\/blog\/enable-security-group-functionality-on-a-microsoft-365-group\/","title":{"rendered":"Enable Security Group Functionality on a Microsoft 365 Group"},"content":{"rendered":"\n

Today, I ran into a situation that many admins will recognize. I needed to deploy an Intune configuration policy to a specific group of users, but the group in question was a Microsoft 365 group. As some of you might know, Intune policies can only be deployed to security-enabled groups, and Microsoft 365 groups, by default, are not security-enabled.<\/p>\n\n\n\n

I could create a new security group and manually add all the same members. However, that\u2019s a maintenance headache, especially if the Microsoft 365 group changes regularly.<\/p>\n\n\n\n

A much simpler approach is to enable the security group flag on the existing Microsoft 365 group. This way you don\u2019t have to manage a duplicate group. The existing group can now be targeted like any other security group in Intune (or elsewhere in Azure AD).<\/p>\n\n\n\n

How to Check if Your Group Is Security-Enabled<\/strong>
You can check whether a group is security-enabled using PowerShell with the AzureAD module.<\/p>\n\n\n\n

Connect to Azure AD and check the group\u2019s properties: <\/p>\n\n\n\n

Connect-AzureAD\n\nGet-AzureADGroup -ObjectId <Your-Group-ObjectID> | FL<\/code><\/pre>\n\n\n\n
Look for the SecurityEnabled<\/code> <\/strong>property. If it’s set to False<\/strong><\/code>, you’ll need to enable it.<\/p>\n\n\n\n
How to Check if Your Group Is Security-Enabled<\/strong>
To enable the security group capability, run the following command:<\/p>\n\n\n\n
Set-AzureADGroup -ObjectId <Your-Group-ObjectId> -SecurityEnabled $True<\/code><\/pre>\n\n\n\n
That\u2019s it! After this change, your Microsoft 365 group can be used just like a traditional security group in Intune or any other Azure AD security-scoped setting.<\/p>\n\n\n\n
How to Check if Your Group Is Security-Enabled<\/strong>
If you don’t know the ObjectId of the group then here\u2019s how to find it:

In PowerShell:<\/p>\n\n\n\n
Get-AzureADGroup -SearchString <Group-Name><\/code><\/pre>\n\n\n\n
This will return key details like DisplayName<\/code>, ObjectId<\/code>, and Mail<\/code>.

In the Azure Portal:<\/p>\n\n\n\n
    \n
  1. Go to Azure Active Directory > Groups.<\/li>\n\n\n\n
  2. Search for your group by name.<\/li>\n\n\n\n
  3. Click the group to open its properties.<\/li>\n\n\n\n
  4. The Object ID is listed on the group’s Overview page.<\/li>\n<\/ol>\n\n\n\n
    Things to Keep in Mind<\/strong><\/p>\n\n\n\n