Azure Group Types
Two main azure group types exist: Security groups and Microsoft 365 groups. Security groups control access to resources, while Microsoft 365 groups help teams work together. Most teams set up these groups in the directory to grant broad roles. When admins assign wide permissions to a group, every member gets too much access. A single bad query or command can then damage live systems. How azure group types work in your directory Security groups act as the main tool for managing access across c
Azure RBAC: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
Two main azure group types exist: Security groups and Microsoft 365 groups. Security groups control access to resources, while Microsoft 365 groups help teams work together. Most teams set up these groups in the directory to grant broad roles. When admins assign wide permissions to a group, every member gets too much access. A single bad query or command can then damage live systems.
How azure group types work in your directory
Security groups act as the main tool for managing access across cloud resources. Admins place users, devices, or service principals inside a Security group. Then, they attach a role or policy to that single group. Every member in the group gets those exact permissions right away. This setup saves time compared to granting roles to one user at a time.
Microsoft 365 groups focus on team projects and shared workspaces instead of strict security. When you create one, the system sets up a shared inbox and calendar. It also creates a file library where members can read and write documents. You can invite people from outside your company into these groups. Still, you cannot put devices or other groups inside a Microsoft 365 group.
Membership rules for cloud groups
Beyond choosing the base type, you must pick how users join the group. Assigned membership means an admin adds and removes each person by hand. This works well for small teams that do not change very often. It gives admins direct control over who holds a role on any day.
Dynamic membership uses rules based on user or device traits to manage the list. If a user changes job titles, the directory updates their group memberships by itself. When someone leaves the team, the rule removes their access without human help. Security groups can use dynamic rules for both people and computers. Microsoft 365 groups only support dynamic rules for user accounts.
Azure RBAC: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What directory groups solve and what they miss
Directory groups solve the hard problem of tracking who belongs on which team. They let you map company departments to cloud roles in one central place. When a new developer joins, you add them to one group. They get access to the right apps, servers, and databases at once. Audits become much easier because you check group lists instead of single accounts.
Yet this setup leaves a major gap in your daily operations. Group permissions only decide who can log in to a database or server. They do not inspect the commands or queries a user runs after logging in. A developer in an approved group can still drop a live table by mistake. They can also pull sensitive data like emails, phone numbers, or card numbers. Static group roles cannot rewrite matched fields in results or block bad commands in flight.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Can I convert a Security group into a Microsoft 365 group?
No, you cannot change the group type after you create it. You must create a new group of the right type and move the members over.
Which group type supports nesting one group inside another?
Security groups allow you to nest other Security groups inside them with assigned membership. Microsoft 365 groups do not support nesting groups at all.
Can I assign cloud resource roles to a Microsoft 365 group?
Yes, you can enable role assignment when you create a new Microsoft 365 group. Most teams still prefer Security groups for strict access control tasks.