A common question in Microsoft 365 management: When you add a user as an owner of a security group in Entra ID (formerly Azure AD), do they automatically get access to the group's resources, or do they need to be added as a member too?

The Short Answer

Adding a user as an owner of a security group does NOT automatically give them access to the group's resources. They should be added as a member as well if you want them to have both management capabilities and access to the group's resources.

Affected Systems

Microsoft 365 Entra ID (Azure AD), specifically impacting security groups and resource access management.

Understanding Group Roles

1. Group Owners:
   • Can manage the group's settings, membership, and properties
   • Have administrative control over the group
   • Cannot access resources granted to the group unless they are also a member
2. Group Members:
   • Can access resources and permissions granted to the group
   • Do not have administrative control over the group

Best Practice Solution

1. For users who need both management capabilities and resource access, add them as both an owner and a member of the group.
2. To do this using PowerShell:

   Connect-AzureAD
   
   $groupObjectId = "group-object-id"
   $userObjectId = "user-object-id"
   
   # Add user as owner
   Add-AzureADGroupOwner -ObjectId $groupObjectId -RefObjectId $userObjectId
   
   # Add user as member
   Add-AzureADGroupMember -ObjectId $groupObjectId -RefObjectId $userObjectId

3. Replace "group-object-id" and "user-object-id" with the actual Object IDs of the group and user respectively.

Additional Notes

• Always double-check both ownership and membership when setting up access rights
• Regular audits of group permissions can help maintain proper access control
• For more granular control over administrative access, consider using Azure AD Privileged Identity Management

Follow-Up

Have you dealt with this issue in your Microsoft 365 environment? We'd love to hear about your experience. Did this solution work for you, or did you find a different approach? Your feedback helps us improve and assists others facing similar challenges. Please share your thoughts in the comments below.

Need More Help?

If you're still puzzled by Microsoft 365 group management or need personalized support, we're here for you. Explore our tailored support options at IT Solver Support Plans. Let's tackle your IT challenges together!