Microsoft 365 Help / Administration
Light Administration

Create a security group and add staff

Use an existing approved access group where possible, or create a new ordinary security group.

About 7 minutes Follow at your own pace

Before you start

  • A Groups Administrator or User Administrator role that permits the change.
  • The approved group name, purpose, owner and member list.

Follow these steps

0 of 6 steps done

  1. Find the groups list

    Select Teams & groups → Active teams & groups, then open Security groups. In some layouts, look for Groups → Active groups. Search for the agreed group first. For an existing group, open it and continue to the membership step.

  2. Create a group if one is needed

    Select Add a security group. Enter the agreed name and a description explaining what access it is for. Select Next.

  3. Keep ordinary group settings

    If asked whether Microsoft Entra roles can be assigned to the group, leave this off for a normal staff access group. Review the name and settings, then select Create group and Close.

  4. Add an owner

    Open the group. On General, choose Add owners if available and select the agreed person. An owner manages the group; being an owner is not a substitute for being a member when resource access is required.

  5. Add the staff members

    Open Members → View all and manage members, then choose Add members if shown. Search for each person by full work email and select the correct match. Select Add or the displayed save button.

  6. Check the member list

    Reopen Members and confirm everyone is correct. To remove someone later, select their name in the member list and use Remove members. Confirm only the intended removal.

You have finished when…

  • The group has a clear purpose and an owner.
  • The member list contains only the approved staff.

Helpful tips

  • A new group grants no SharePoint or mailbox access until permissions are assigned to it at that resource.
  • Initech groups beginning PRIV- may already represent approved access. Confirm the exact group and its purpose with IT; do not guess from the name.

Something looks different?

The members cannot be edited here

It may be a mail-enabled security group, a dynamic group or a group managed elsewhere. Mail-enabled security group changes are handled through Exchange by an authorised administrator.

The new member still cannot open a folder

Confirm the group has access to that resource. Allow changes to take effect, then ask the person to sign out and back in.

Microsoft help & further guidance

Menu names can change as Microsoft updates the apps. These official pages include further instructions.

Next guide in this sectionGive a group access to company files