Overview
The Groups tab in Explore lists every Microsoft Entra ID group that the last sync read from a tenant. You see what each group assigns, how many members and owners it has, and how its membership is set. You can open a record for one group to see its licenses, members, and owners, and to request changes to them.
These are Microsoft Entra ID groups. They are not the tenant groups that organize your tenants. For those, see Managing tenant groups.
Business value
Licenses that members receive through a Microsoft Entra ID group are easy to lose track of. This tab shows which groups assign licenses, which ones nobody owns, and which ones are empty, so you can fix the group instead of chasing individual users.
Prerequisites
Before you use the tab, connect the tenant and let it finish its first sync. See Connect a Microsoft 365 tenant.
Required permissions
You need Read on Explore to view Microsoft Entra ID groups and open records. You need Manage on Explore to request changes from a record. The Owner and Contributor roles have both, and the Reader role has Read only. For details, see Roles and permissions in Tenant Manager.
Dependencies
The list shows what the last sync read from Microsoft. It isn't live. The grid features that this tab shares with the other Explore tabs, such as filters, columns, and the Excel download, work as described in Explore users.
How it works
Select the tenant in the tree view, expand License management, select Explore, and then select the Groups tab. Explore is available for a tenant only.
Tiles and filters
Four tiles sit above the grid. Selecting a tile picks the matching filter.
| Tile | What it shows |
|---|---|
| Groups in scope | Every synced Microsoft Entra ID group. |
| Groups with licenses | Microsoft Entra ID groups that assign licenses to their members. |
| Dynamic | Microsoft Entra ID groups whose members are set by a rule. |
| Without users | Microsoft Entra ID groups that have no members and no owners. |
The filter pills cut the list: All groups, With licenses, Without licenses, Dynamic, No owners, No members, and No users. No users means no members and no owners.
Columns and records
The grid has these columns. You can show or hide them in Column options.
| Column | What it shows |
|---|---|
| Group | The Microsoft Entra ID group name. This column is always shown. |
| Type | Security, Mail-enabled security, Microsoft 365, or Distribution. Security groups control access to apps and resources. Microsoft 365 groups give a team a shared mailbox, calendar, and files. Mail-enabled security and Distribution groups are used for email. |
| Membership | Assigned or Dynamic. Members of an assigned Microsoft Entra ID group are added by hand. Entra ID adds and removes the members of a dynamic group based on a rule, so you can't change them by hand. |
| Members | How many people are members. It shows "Not tracked" until the next sync reads the group. A group with no members shows 0. |
| Owners | How many people or apps own the Microsoft Entra ID group and manage who is in it. Owners aren't the same as members. |
| Membership rule | The rule of a dynamic group. |
| Licenses assigned, Source, Tenant | Hidden by default. |
Selecting a row opens the record of that Microsoft Entra ID group.
| Tab | What it shows |
|---|---|
| Summary | Tiles for paid seats, cost per month, members, and owners. Facts such as type, membership, source, last synced, and the membership rule. Notices when disabled members still get paid seats, or when nobody owns a Microsoft Entra ID group that gives out paid licenses. |
| Licenses | The licenses the Microsoft Entra ID group assigns. A group gives one seat to each member, including anyone who joins later. |
| Users | The owners and members. You can filter by group role and by user type. |
Use ‹ and › to step through the groups in the order of the grid. Names of users and licenses inside a record are links. Selecting one opens that record on top of the current one, and closing it returns you to the group.
Steps
The steps below cover the common tasks on the Groups tab. You start in Explore for the tenant, with the Groups tab open.
Find Microsoft Entra ID groups that need attention
This procedure lists Microsoft Entra ID groups that are easy to overlook.
- Select a filter pill such as No owners or No members.
- Review the list. To narrow it, use the filter menu of a column, such as Membership.
- Select a Microsoft Entra ID group to open its record.
You can also download the list. Select Download as Excel to save "Tenant Manager - Groups.xlsx".
Request a change for a Microsoft Entra ID group
This procedure creates a task in Optimization for an approver to decide. Nothing changes in Microsoft 365 until the task is approved.
- Open the record of the Microsoft Entra ID group.
- Select Actions.
- Choose a request: Request to add user, Request to add license, Request to remove licenses, or Request to remove users.
- Choose the items in the dialog, read the confirmation, and select Send request.
To remove several licenses or users in one request, tick the rows on the Licenses or Users tab, and then choose Request to remove licenses or Request to remove users from the Actions menu. Rows on the Users tab also have their own remove button.
The request appears in Optimization > Tasks with the status Awaiting approval.
Permission behavior
What you can do depends on your role.
- Without Read on Explore, the page shows "You do not have access to this page".
- Without Manage on Explore, the request actions are disabled. Hover over one to see "You are not authorized to perform this operation".
- Tenant Manager can't change the members of dynamic Microsoft Entra ID groups, Microsoft Entra ID groups synced from on-premises, or distribution and mail-enabled security groups. The record explains why.
Example scenario
During an access review at Proseware, Ines Carvalho, a module owner, opens Explore for the tenant Proseware Lisbon, selects the Groups tab, and picks No owners. The list shows a Microsoft Entra ID group that assigns licenses and has no owner, so anyone added to it gets a paid seat.
She opens the record of the Microsoft Entra ID group and reads the notice on the Summary tab. She asks the group's team lead to add an owner in Microsoft Entra ID.
Limitations
- Explore is available for a tenant, not for a tenant group.
- You can't edit Microsoft Entra ID groups directly. A request becomes a task that needs approval.
- The members of dynamic, on-premises synced, distribution, and mail-enabled security Microsoft Entra ID groups can't be changed here.
- The list shows the last sync. It isn't live.
Troubleshooting
-
The tab shows "No groups synced yet".
Cause: the tenant hasn't completed a sync.
Fix: sync the tenant. Syncing needs the Manage tenants permission. -
A request action is disabled on a Microsoft Entra ID group.
Cause: the group is dynamic, synced from on-premises, or a distribution or mail-enabled security group, or your role doesn't have Manage on Explore.
Fix: change a dynamic group's rule in Microsoft Entra ID, or ask an administrator who can manage Tenant Manager access, such as a module owner, to add Manage on Explore. -
A removal request is blocked and says that a user is excluded.
Cause: the user is excluded from removals in Tenant Manager.
Fix: include the user in removals first, if the removal is intended. If you select several users and only some are excluded, Tenant Manager skips the excluded users and sends the request for the rest. -
A request says that the change is already requested and waiting for approval.
Cause: an open task already covers that change.
Fix: approve or decline the task in Optimization > Tasks, and then raise the request again. -
A message says that some data could not be loaded.
Cause: one of the reads for the page failed, so the list may be incomplete.
Fix: reload the page. If the message returns, check that your Tenant Manager access covers this tenant. A message that reads "This tenant is outside your Tenant Manager access" means your role isn't granted on it.
FAQs
-
Are these the tenant groups I create in Tenant Manager?
No. These are Microsoft Entra ID groups that the sync read from the tenant. Tenant groups organize tenants. -
Why can't I remove a license from a person who gets it through a Microsoft Entra ID group?
A person who gets a license through a Microsoft Entra ID group keeps it while they stay in the group. Change the group's licenses, or remove the person from the group. -
Does a request change the Microsoft Entra ID group in Microsoft 365?
No. A request creates a task. Nothing changes until an approver approves it.