TL;DR
This automation uses Power Automate and Microsoft Graph API to create a security group in Entra directly from an existing Microsoft 365 group, then replicates its full membership automatically. It covers generating an access token, creating the group, looping through members, and handling errors, removing the need to manually recreate group structures for access control or role-based permissions across your organization.
Overview
This automation process is designed to streamline the creation of a security group in Microsoft Entra (Azure AD) from an existing Microsoft 365 (M365) group and replicate its membership. This is particularly useful when you want to apply security policies, access control, or role-based access management using security groups while leveraging existing organizational structures defined in M365 groups.
This automation is built in Power Automate and leverages:
- HTTP connector (for Graph API calls)
- Microsoft Entra (Azure AD)
- Office 365 Groups
- Dynamic expressions for content parsing and transformation.
Use Case
Organizations often use Microsoft 365 groups for collaboration (Teams, Outlook, Planner, etc.), but Entra security groups are required for administrative control, role assignments, or integration with external systems. Manual replicating groups and their members can be time-consuming and error prone. Automating this process saves time and ensures consistency.
Process Outline
The automation performs the following steps:
- Trigger the flow manually or based on an event.
- Get details of the source M365 group using Microsoft Graph.
- Extract the group’s display name and ID.
- Create a security group in Entra using the same naming convention (with cleaned mailNickname).
- Fetch all members of the source M365 group.
- Loop through the members and add each member to the new security group.
- Provide logging or output summary of success or errors.
Step-by-Step Breakdown
Step 1: Trigger the Flow
The flow can be manually triggered, scheduled, or integrated with another system or form input (e.g., a Power App or SharePoint list). In this example, a manual trigger is used to start the process with minimal user input.
Step 2: Generate Access Token
For the service principal created, use its token id, client id, client key and scope to generate the ‘Access Token’. This access token will be used for authorization purposes in further steps.
Step 3: Get M365 Group Details
Use the HTTP connector to call Microsoft Graph and retrieve group metadata. The following parameter can be for the same:
GET <Microsoft Graph API url>?$filter=groupTypes/any(c:c eq ‘Unified’).
This call returns a list of M365 groups. You can use a Compose action to extract the group name for later use.
first(body(‘<output of previous step>’)?[‘value’])?[‘displayName’]
Step 4: Clean the Display Name for mailNickname
The mailNickname must follow strict naming rules (no spaces or special characters). You use Power Automate expressions to transform the display name into a valid alias:
replace(outputs(‘Compose’), ‘ ‘, ”)
This creates a prefix (sec-) and removes any spaces from the group name.
Step 5: Create the Security Group
Use the HTTP POST method to create a security group in Entra:
POST <Microsoft Graph API url>
Headers:
Authorization: Bearer <token>
Content-Type: application/json
Body:
{
“displayName”: “<Group Name>”,
“mailNickname”: “<Nick Name of your choice”,
“mailEnabled”: false,
“securityEnabled”: true
}
This call creates a mail-disabled, security-enabled group. You capture the returned id of the new group for further operations.
Step 6: Fetch Members of the M365 Group
Using the original M365 group’s ID, call the Graph API to retrieve all members:
GET <Microsoft Graph API url> /v1.0/groups/{group-id}/members
This returns an array of member objects, including their IDs.
Step 7: Loop Through Members and Add to Security Group
Use an ‘Apply to each’ loop to iterate through each member object returned in the previous step.
Inside the loop, use another HTTP POST call:
POST <Microsoft Graph API url> /{security-group-id}/members/$ref
Body:
{
“@odata.id”: “<Microsoft Graph API url> /v1.0/directoryObjects/{member-id}”
}
This adds the user to the security group by referencing their directory object ID. You can add error-handling logic here to catch issues like disabled accounts or existing membership.
Step 8: Output Results
Use Compose or Append to string variable actions to log member additions, errors, or time taken. Optionally, send a final email with the summary or store it in a SharePoint list or Excel sheet.
Key Considerations
Authentication
The HTTP connector uses OAuth 2.0 authentication with a registered app in Entra (Azure AD). Make sure:
- The app has Group.ReadWrite.All, User.Read.All, and Directory.ReadWrite.All permissions.
- You’ve granted admin consent.
- The token is correctly generated and passed in the Authorization header.
Error Handling
Implement try-catch patterns using Scope, Configure Run After, and Terminate actions for robust error handling, especially:
- If group creation fails
- If adding a member fails
- If the source group is empty
Benefits of This Automation
- Time-Saving: Automates repetitive, manual IT tasks.
- Accuracy: Reduces human errors during group replication.
- Consistency: Ensures naming conventions and group structures are followed.
- Integration Ready: Can be triggered by service requests, apps, or other flows.
Conclusion
This Power Automate flow provides an efficient and scalable way to replicate Microsoft 365 groups into Entra security groups, ensuring consistent access control and centralized user management. With Graph API, expressions, and robust logic, it’s a perfect example of how automation can enhance IT processes while aligning with enterprise security and compliance goals.
Why Partner with Addend Analytics for Power Automate & Identity Automation
Building a flow like this is straightforward on paper, but production environments rarely stay that simple. Real tenants have inconsistent naming conventions, nested group memberships, throttled API calls, and permission structures that don’t always match the documentation. Getting it wrong doesn’t just break a flow, it can lock users out of systems or leave a security gap that goes unnoticed for months.
At Addend Analytics, we build Power Automate solutions that hold up in real IT environments, not just in a demo. Our team has hands-on experience with Microsoft Graph API, Entra ID governance, and enterprise-scale automation across Microsoft 365 tenants of varying complexity. We don’t just get the flow running, we build in the error handling, logging, and monitoring that make it something you can actually trust to run unattended.
Frequently Asked Questions
Common questions about creating and managing Entra security groups with Power Automate.
Group.ReadWrite.All, User.Read.All, and Directory.ReadWrite.All permissions granted with admin consent. Without admin consent, the Graph API calls will fail even if the permissions are added.
mailNickname must not contain spaces or special characters. Using a Power Automate expression like replace(outputs('Compose'), ' ', '') to strip spaces from the display name before creating the group usually resolves this.
GET /v1.0/users/{userPrincipalName}, then reference that ID in the @odata.id body when adding them to the target group.
Author By
Kamal Sharma
Kamal brings over 20 years of experience in data analytics and business intelligence. He has led the design and implementation of analytics solutions across operations, financial reporting, and performance improvement initiatives. With a background in business statistics and Six Sigma, his work focuses on applying data in a structured and practical way to solve real business challenges.
