Introduction to Group Management

Atria offers Universal Group Management for all four core group types.  Core administration is now possible through the Atria UI.

The Core Group Types Supported

• Azure AD Security Groups
• Distribution Groups
• Mail Enabled Security Groups
• Microsoft 365 Groups

Each group type has different properties and features, the edit form will differ slightly across group types.  Note that there are currently some limitations with available APIs which may restrict functionality available for some group types.

Atria interacts with Microsoft APIs directly, data is retrieved from Microsoft and updated in real time, the time taken to complete tasks can be variable depending on group type. 

Distribution groups and Mail Enabled Security Groups can only be created if a tenant has a Microsoft Online subscription that has been activated.  The group selector will hide these two group types if Exchange Online is not activated.  (Exchange Online is activated when the first license containing Exchange Online is assigned to a user - this triggers the internal Microsoft provisioning process for Exchange Online)

Access and Security

Default Permissions

• Microsoft Online Administrators role – has full access to create, update, read and delete all groups.  This is the default permission that will be granted to end-customer administrators if permissions have not been modified.
• Reseller and Service Provider administrators will by default be able to manage on behalf of their customers.

Advanced Permissions Control

There are four core permissions available which can be added to Atria Security Roles, they are all contained under the Microsoft Online Service Segment. 

• Create Group
• Read Group
• Update Group
• Delete Group

Menu Access

The default menu item for accessing the group management feature is

• Services > Microsoft Online > Group Management

Auditing

Atria audits changes to groups in the [MicrosoftOnlineGroups_AT] database table.  Changes are stored against the user who performed the change, and also any impersonation that has been included.

Note that any groups created outside of Atria will not have a created record within this table, but any subsequent updates to the group, made through Atria, will be recorded.

Dynamic Groups

Dynamic groups are not shown and cannot be created through Atria.

Synced Groups

Groups that are synchronized into Azure AD using Azure AD Connect cannot be edited.  Atria will let you view these groups but they will be read-only.

Creating Groups

The group selector allows you to choose the group type, once a group type has been selected, the group type cannot be changed.

If you create a group, then immediately go to edit the group, although the group appears to have been created, it can take time before the new group will appear in successive queries to the Microsoft API, if an error is shown, waiting a few seconds then trying again will usually resolve the problem. 

Editing Groups

Editing groups provides the same dialog used to create groups, simply select the required group from the list, and edit the properties as required.