{"id":8059,"date":"2026-10-01T10:52:55","date_gmt":"2026-10-01T08:52:55","guid":{"rendered":"https:\/\/blog.redbaronofazure.com\/?p=8059"},"modified":"2026-10-01T11:26:47","modified_gmt":"2026-10-01T09:26:47","slug":"entra-administrative-units-instead-of-group-readwrite-all","status":"publish","type":"post","link":"https:\/\/blog.redbaronofazure.com\/?p=8059","title":{"rendered":"Entra Administrative Units instead of Group.ReadWrite.All"},"content":{"rendered":"\n

What do you do if you have an app that needs to create and manage its own groups? You can grant the app the Graph API permission Group.ReadWrite.All, but that would mean it can manage any<\/em> group in the tenant and that is a security concern as it gives the app too much power. <\/p>\n\n\n\n

Instead, you can grant the app’s service principal (SP) the Groups Administrator<\/strong><\/em> role scoped to an Administrative Unit<\/em><\/strong> (AU). This way the app can create groups and add\/remove users to it but only within the AU. The SP can not manage groups that are outside the AU. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Creating the Administrative Unit<\/h2>\n\n\n\n

In the Entra portal, goto Roles & admins<\/em>, then Admin units<\/em> and click + Add<\/em> and a create a new AU like this.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Click into the new AU and select Roles and administrators<\/em>, find role Groups Administrator<\/em> and click on it.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Next, click + Add assignments<\/em> and find your app that needs to manage its own groups<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now, your app’s service principal have the scoped permission to create and manage groups within the AU.<\/p>\n\n\n\n

Create and manage groups via the Service Principals scoped permission<\/h2>\n\n\n\n

First, authenticate the SP using client credentials<\/p>\n\n\n\n

 $auth = Invoke-RestMethod -Method Post -Uri \"https:\/\/login.microsoftonline.com\/$tenantId\/oauth2\/v2.0\/token\" `\n    -ContentType \"application\/x-www-form-urlencoded\" `\n    -Body @{ grant_type=\"client_credentials\"; client_id=$ClientId; client_secret=$ClientSecret; scope=\"https:\/\/graph.microsoft.com\/.default\" }\n\n$authHeader =@{ 'Content-Type'='application\/json'; 'Authorization'='Bearer ' + $auth.access_token }    \n<\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
Prove the SP doesn’t have too much power<\/h3>\n\n\n\n
Next, to prove that the SP doesn’t have too much power, try to create the group outside of the AU. This attempt fails with Authorization_RequestDenied<\/em> and Insufficient privileges<\/em> as it should.<\/p>\n\n\n\n
$groupName = \"App-GroupOne\"\n$bodyG = @\"\n{\n  \"displayName\": \"$groupName\",\n  \"mailNickname\": \"$groupName\",\n  \"mailEnabled\": false,\n  \"securityEnabled\": true,\n  \"description\": \"SP with AU scoped permission creating a new group via Graph API\",\n  \"@odata.type\": \"#microsoft.graph.group\",\n  \"owners@odata.bind\": [\"https:\/\/graph.microsoft.com\/v1.0\/directoryObjects\/$spObjectId\"]\n}\n\"@\n<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Create the group within the AU<\/h3>\n\n\n\n
To create a group using the SP’s scoped permission to the AU, we need to call the AU’s Graph endpoint https:\/\/graph.microsoft.com\/v1.0\/directory\/administrativeUnits<\/strong>\/$auId\/members<\/em> and not the standard \/groups<\/em> endpoint. We pass the same request body.<\/p>\n\n\n\n
$group = Invoke-RestMethod -Headers $authHeader -Method \"POST\" -Uri \"https:\/\/graph.microsoft.com\/v1.0\/directory\/administrativeUnits\/$auId\/members\" -Body $bodyG<\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
Manage the new group<\/h3>\n\n\n\n
Once the new group is created, the SP can use the standard \/groups endpoint to add\/remove members. In the below example we add the SP as a member, but this could be a user’s UPN.<\/p>\n\n\n\n
$bodyGM = @\"\n{\"@odata.id\":\"https:\/\/graph.microsoft.com\/v1.0\/directoryObjects\/$spObjectId\"}\n\"@\nInvoke-RestMethod -Headers $authHeader -Method \"POST\" -Uri \"https:\/\/graph.microsoft.com\/v1.0\/groups\/$($group.id)\/members\/`$ref\" -Body $bodyGM\n<\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
Get details of the group<\/h3>\n\n\n\n
Invoke-RestMethod -Headers $authHeader -Method \"GET\" -Uri \"https:\/\/graph.microsoft.com\/v1.0\/groups\/$($group.id)?`$select=id,displayName,description<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Where is the group visible?<\/h2>\n\n\n\n
If you create a group within an AU, where is it visible in the Entra portal? It shows up in two places. First, it is visible amongst the other groups and there is no obvious difference.  <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
If you view the group details and select the Administrative units menu option, you see that it exists within an AU.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Reversely, if you view the AU itself, you will see the group listed as an AU member.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
The bad news<\/h2>\n\n\n\n
If you think this looks good, there is one downside. The app will need the Directory.Read.All<\/em> application permission as documented by Microsoft (link here<\/a>). So you trade not granting the app Group.ReadWrite.All<\/em> for instead granting it Directory.Read.All<\/em>. If you don’t grant the app Directory.Read.All<\/em>, the creation of group and managing it will fail as the SP hasn’t the ability to verify member objects.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
There is another option here and that is to create a custom role that works like Directory.Reader.All and scope that role to the SP within the AU. This More about that in a later post.<\/p>\n\n\n\n
The group owner solution<\/h2>\n\n\n\n
If you are not too keen on granting the SP Directory.Read.All<\/em> permission, there is another possible solution. If the groups can be pre-created, ie not dynamically created within the app, you can make the SP an owner of the group(s). Group owners can manage group membership without having Group.ReadWrite.All.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
$group2 = Invoke-RestMethod -Headers $authHeader -Method \"GET\" -Uri \"https:\/\/graph.microsoft.com\/v1.0\/groups?`$filter=DisplayName eq 'App-GroupTwo'\"\n\nInvoke-RestMethod -Headers $authHeader -Method \"POST\" -Uri \"https:\/\/graph.microsoft.com\/v1.0\/groups\/$($group2.value[0].id)\/members\/`$ref\" -Body $bodyGM<\/code><\/pre>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
What do you do if you have an app that needs to create and manage its own groups? You can grant the app the Graph API permission Group.ReadWrite.All, but that would mean it can manage any group in the tenant and that is a security concern as it gives the app too much power. Instead, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[464,453],"tags":[466,465],"_links":{"self":[{"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=\/wp\/v2\/posts\/8059"}],"collection":[{"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8059"}],"version-history":[{"count":10,"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=\/wp\/v2\/posts\/8059\/revisions"}],"predecessor-version":[{"id":8085,"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=\/wp\/v2\/posts\/8059\/revisions\/8085"}],"wp:attachment":[{"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8059"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8059"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.redbaronofazure.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8059"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}