Groups
Open Unified Identities › Group, filter Providers to Entra ID › Group, then select a row to open its details.
Group Details
Opening a group shows the Risk and Exposure Point in the header, and the page contains the Information and Issues panes.
Information
Information Pane can contain different badges to highlight important attributes.
Shadow
Indicates that the object can compromise admin objects with at least one attack path.
Privileged
Indicates that the object is Privileged.
ARM Privileged
Indicates that the identity has at least one privileged Azure Resource Manager role assignment at resource group scope or higher.
Tier 0 / Tier 2
Indicates the tier of the object.
Information Pane contains Details, Parent Groups, Child Groups, Child Users, Child Devices, Child Service Principals, Child Administrative Units, Owner Users, Owner Service Principals, ARM Roles and Policies tabs respectively. Each tab carries the number of rows it holds in its label.
Details
Details tab contains attributes below about group object.
Name
The unique name or alias of the group, used for identification and referencing within Azure AD.
Description
A user-defined text field describing the group's purpose or membership.
Display Name
The name shown in the directory, often used in address books and group listings.
Tenant
The Entra ID tenant to which the group belongs, linking to its Tenant page.
Security Enabled
Indicates whether the group is a security group, which can be used to manage access to resources like SharePoint, Teams, or applications.
Group Type
Defines the type of group: Security for access control or Microsoft 365 for collaboration (this group is a Security group).
When Created
The date and time when the group was created in the Azure Active Directory.
Is Assignable To Role
Indicates whether this group can be assigned to Azure AD roles (role-assignable groups must be security-enabled and marked as assignable).
On Prem SID
The security identifier (SID) for the group from the on-premises Active Directory, used during synchronization.
On Prem Sync Enabled
Specifies whether the group was synchronized from an on-premises Active Directory via Azure AD Connect.
Security Identifier
A unique SID assigned by Azure AD for the group object, used in access control and permissions.
Parent Groups
Parent Groups tab contains a list of groups that the group is a member of. This list also contains Enabled and On Prem Sync Enabled columns to identify the status of these groups.
Child Groups
Child Groups tab contains a list of groups that are members of the group. This list also contains Enabled and On Prem Sync Enabled columns to identify the status of these groups.
Child Users
The Child Users tab displays a list of user accounts associated with the group.
Child Devices
The Child Devices tab displays a list of devices objects associated with the group.
Child Service Principals
The Child Service Principals tab displays a list of Service Principals associated with the group.
Name: The name of the Service Principals.
Enabled: Indicates whether the Service Principals is active.
App Display Name: The display name of the Azure AD application that this service principal is associated with.
Service Principal Type: The type of the service principal, which defines its origin.
Common types include:
Application: a service principal created for an Azure AD application.ManagedIdentity: for system- or user-assigned managed identities.Legacy: for older service principal objects.Federated: for service principals from external identity providers
Child Administrative Units
The Child Administrative Units tab displays a list of Administrative Units associated with the group.
Display Name: The display name of the Administrative Unit, used to identify it within Azure AD.
Member Management Restricted: Indicates whether non-global administrators are restricted from managing members of this Administrative Unit. When set to true, only scoped-role assignments can manage its members.
Visibility: Determines whether the Administrative Unit is visible to users in the directory. Values can be:
Public: visible to all users.HiddenMembership: members are not visible to non-admin users.Private: not visible unless explicitly granted access.
Owner Users
The Owner Users tab displays a list of Owner Users associated with the group.
Owner Service Principals
Owner Service Principals tab contains a list of service principals that own the group.
ARM Roles
ARM Roles tab contains a list of the Azure Resource Manager role assignments held by the group, with Type, Built In and Assigned columns. Every member of the group inherits these, so a group with resource-plane roles widens the blast radius of each membership.
Policies
Policies tab lists the Conditional Access policies that apply to the group.
Name: The policy the row is about, linking to its Conditional Access Policy page.
State: Whether the policy is Enabled, Disabled or Report-only.
Because Conditional Access is usually assigned to groups rather than to individual users, this tab is the quickest way to see what a group actually grants or demands before changing its membership. CAP Audit reports the same relationship from the policy side.
Issues
Issues pane contains identified issues on the group object.
Last updated
Was this helpful?