Groups Administrator

Create and manage groups and group settings across Microsoft Entra ID.

Least-privilege guidance: Use instead of User Administrator when group lifecycle is the actual responsibility.

Assignment playbook

Grant the role without creating standing risk

Choose the narrowest role, scope, duration, and activation model that still completes the task.

Decision checks

Confirm the operator needs to perform one of the listed tasks, not a broader adjacent task.
Cannot manage every role-assignable group operation or unrelated user and application settings.
Check whether a workload-specific role or administrative-unit scope can narrow access further.

Recommended assignment

Use instead of User Administrator when group lifecycle is the actual responsibility.
Prefer an eligible PIM assignment for occasional administration; use a time-bound active assignment only when the workflow requires it.
Scope the assignment to an administrative unit or application when the role supports that scope.
Require MFA, justification, approval, and a short activation duration for privileged roles where practical.

Verify

Confirm the assignment appears at the expected scope and as eligible or active as designed.
Activate the role if required, then test the smallest intended task and one nearby task that should remain denied.
Review Entra audit logs for the assignment/activation and record the ticket or business justification.

Escalate when

The role documentation lists the action but the activated, correctly scoped assignment still cannot perform it.
The task succeeds only with a broader role; verify whether an additional Graph permission, workload RBAC role, ownership, or license is required.
You can provide the principal, role, assignment scope/type, activation time, target resource, correlation ID, and sanitized audit event.

Role assignment evidence template

Role: Groups Administrator
Principal object ID: <guid>
Assignment scope: <tenant | administrative unit | application>
Assignment type: <eligible | active>
UTC activation/test time: <yyyy-mm-dd hh:mm:ssZ>
Correlation ID: <guid>

Template only. Record object IDs in a private ticket; never include credentials or tokens.

Read role assignment schedule instances

GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleInstances?$filter=principalId eq '<object-id>'

Read-only Microsoft Graph request. Requires an appropriately permissioned administrative session.

← Search another role

Common tasks

Create and delete groups
Manage group memberships and owners
Manage group expiration and naming settings

What it cannot do

Cannot manage every role-assignable group operation or unrelated user and application settings.