Group Settings
Open Tenant Admin → System → Settings → Groups to control group creation, Entra naming, and synchronization. These settings require a tenant administrator.
Choose who can create groups
| Setting | Effect |
|---|---|
| Can users create own groups | Allows users to create groups from My groups and application setup. Enabled by default. Turning it off blocks new group creation by users; existing ownership and access remain. Tenant administrators can always create groups. |
| Create integration groups in Entra | Creates new integration-setup groups as Entra security groups when the integration is saved. Disabled by default. Existing groups are not converted, and groups created directly from My groups remain local. |
Entra creation requires a configured Customer Broker or an updated, connected Agent Broker with Group.ReadWrite.All. The AZExecute Broker supports reading groups only. See Entra ID Integration for connection setup.
Select Save group settings after changing creation or naming options. The sync controls below have their own save buttons.
Name new Entra integration groups
When Entra creation is enabled, choose an example or enter a Prefix, Name pattern, and Postfix. They form one name in that order; include any spaces or separators you want.
Use {{ groupname }} for the chosen group name, {{ integrationname }} for the saved integration name, and {{ applicationname }} for the application name. Variables work in all three fields. The complete name must be between 1 and 256 characters.
| Prefix | Name pattern | Postfix | Example result |
|---|---|---|---|
AZX- | {{ groupname }} | None | AZX-Finance |
AZX- | {{ groupname }}-{{ integrationname }} | None | AZX-Finance-GitHub Production |
APP- | {{ applicationname }} | -Access | APP-Finance Portal-Access |
Use Live name preview to try your own values before saving. Preview values do not create a group. Naming changes apply to new integration groups; existing groups keep their names.
Sync groups from Entra
Sync imports group names, descriptions, and direct user members through your configured Entra broker. Only users already registered in the AZExecute tenant become members. Nested group membership is not expanded.
- Configure and enable the Entra ID integration. For Agent Broker, use an updated agent with a live connection.
- In Settings → Groups → Entra group sync, turn on Enable scheduled group sync.
- Choose Sync all groups, or add up to 20 Starts with or Equals filters. A group only needs to match one filter.
- Select Save and sync now to apply the selection immediately, or Save sync settings for the next scheduled run. Sync runs hourly by default.
- Check Last successful sync and the created, updated, disabled, and name-conflict counts.
For example, Starts with aad includes aad-Finance and aad-IT. Adding Equals Helpdesk includes that group too. Use short names or prefixes; the editor reports filters that are too long.
- Matching again reactivates the same group with its saved assignments. Enabling Sync all groups also brings existing groups back into scope.
- A confirmed deletion in Entra deactivates the AZExecute group. Sync never deletes directory groups or local resource assignments.
- Failed syncs preserve existing groups and memberships. Turning scheduled sync off preserves the current state; it does not revoke access.
- Name conflicts do not merge groups. Rename the conflicting local or Entra group, then sync again.
Review and remove groups
Use Tenant Admin → Access Control → Groups to review all groups. Filter by Source or Status to find local, Entra, active, or deactivated groups. In Personal settings → My groups, users see only active groups with an active membership.
For Entra groups, manage names, descriptions, and user membership in Entra, then sync. Resource assignments remain managed in AZExecute.
To remove saved groups permanently, select Delete groups, choose the source and status, then Review deletion. Check the listed groups and assignments before typing the required confirmation. This removes AZExecute groups and their links, not the underlying resources or Entra directory groups.
Cleanup that includes Entra pauses group sync. Re-enabling sync can import matching groups again, but cannot restore assignments removed by deletion.
See Groups for membership, resource access, and application integration workflows.