Introducing the Groups Admin Role
Today, we are thrilled to announce that the the Groups admin role in Azure Active Directory (Azure AD) is now generally available. This new Azure Active Directory role enables you to perform group management tasks for and Azure AD security groups without requiring Global administrator permissions. Users with the Groups administrator role can use the Microsoft 365 Admin center, the Azure portal and other methods to create, edit, delete, and restore groups, and manage Office 365 Groups policies (example - creation, naming, and expiration policies). Figure 1 - Managing Groups in the Microsoft 365 Admin center Figure 2 - Managing Groups in the Azure portal You can provision the Groups admin role using Azure AD PowerShell: #Below steps need to be completed only once to install the Azure AD scripts Install-Module -Name AzureAD #Connect (use privileged role) Connect-AzureAD # Get the user to be assigned the role, replacing foo@contoso.com with the email address of the user $roleMember = Get-AzureADUser -SearchString "foo@contoso.com" # Enable the role for the tenant (skip this step if you have already enabled the role for your tenant). If you have already enabled the role, you will get an error (which you can ignore) $newRole = Enable-AzureADDirectoryRole -RoleTemplateId "fdd7a751-b60b-444a-984c-02652fe8fa1c" # Get the newly added role - replace the role template Id as per need $newRole = Get-AzureADDirectoryRole -Filter "roleTemplateId eq 'fdd7a751-b60b-444a-984c-02652fe8fa1c'" # Add the user to this role - copy the object Id from the output of the above command and use below Add-AzureADDirectoryRoleMember -ObjectId $newRole.ObjectId -RefObjectId $roleMember.ObjectId Limitations There are a few limitations that we are looking to address soon: The admin role is designed mainly for Office 365 groups and cannot manage other group types like distribution groups, mail-enabled security groups or shared mailboxes. This role cannot be used to update a Group’s email address or modify external mail or mail delivery options in the Microsoft 365 admin center. You cannot use Exchange PowerShell cmdlets to manage Office 365 Groups. A Groups admin cannot manage audit logs, access reports, or guest settings. We would love to hear your feedback or suggestions. Leave a comment here or reach out to us on user voice.
Graph API permission issue to update Office 365 group settings via Application user(ClientId/Secret)
Hello Everyone, I'm facing an issue updating the allowExternalSenders setting for a Microsoft 365 Group. I've tried various methods, including granting permissions of App to Groups and Directories, adding an App role, in the App and even assigning my App to the Azure Global Admin Security role, but nothing seems to be working. Does anyone have any suggestions or solutions for this problem? below is the error. Failed to update group settings: {"error":{"code":"ErrorGroupsAccessDenied","message":"User does not have permissions to execute this action.
O365 groups missing - SharePoint Modern Team Site
Hello Everyone, We have over 450+ team site in our SPO tenant and we started to noticed that most of these site does not have an O365 group associated/attached to it. Looks like O365 groups did not get created during the site creation. > The built in filter view in SPO admin page- active sites - shows that all the sites has O365 groups however cannot find them under groups in any admin page (SPO,Exchange groups, or in AzurePortal) > Tried to create a new group via PS and i get this message Connect-SPOService -Url $SPOAdminCenterUrl -Credential $O365Cred $GroupDisplayName="Group Display Name" $GroupAlias="GroupAlias" Set-SPOSiteOffice365Group -Site $ModernSPOSite -DisplayName $GroupDisplayName -Alias $GroupAlias ==== Output ==== Set-SPOSiteOffice365Group : This site already has an O365 Group attached. At line:5 char:1 + Set-SPOSiteOffice365Group -Site https://modern.sharepoint.com/sites ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Set-SPOSiteOffice365Group], ServerException + FullyQualifiedErrorId : Microsoft.SharePoint.Client.ServerException,Microsoft.Online.SharePoint.PowerShell.SetSPOOffice365Group Any suggestion on how to get a report or list of all the site which does not have O365 groups associated to the Modern site Thanks in advanced.Is there a "Sent" folder for an O365 Group Conversation?
If I grant a user access to SendAs the O365 Group, and they send an email "as the group", and they don't copy themself, where does that email actually go. I can't find any record of it anywhere inside the group (only in the inbox of the recipient).Hiding Office 365 Groups Created by Teams from Exchange Clients
Teams now hides the Office 365 Groups that it creates from Exchange clients (Outlook, OWA, and the mobile apps). That’s as it should be for groups created for new teams. If you want to hide groups created for older teams, you can run the Set-UnifiedGroup cmdlet, but that soon becomes boring when you might have hundreds of groups to process. PowerShell to the rescue once again. https://www.petri.com/hiding-office-365-groups-exchange-clients
