Microsoft 365 Groups: Differences Between Creation Portals

Introduction: why the group creation portal really matters

In a Microsoft 365 and Microsoft Entra ID environment, creating a group seems like a straightforward operation. Yet a technical reality often overlooked hides behind this action: depending on the portal used, the underlying attributes securityEnabled and mailEnabled are not positioned the same way. A Microsoft 365 group created from the Microsoft 365 Admin Center does not present the same technical configuration as its equivalent created from Teams or via the Microsoft Graph API.

This subtlety has direct implications for identity governance, access rights assignment, and the consistency of security policies. This article details these differences portal by portal and proposes a structured approach to avoid inconsistencies in your directory.

Mapping of portals and group types

Five main portals enable group creation in the Microsoft 365 ecosystem:

• Microsoft Entra Portal (entra.microsoft.com)
• Microsoft 365 Admin Center (admin.microsoft.com)
• Exchange Admin Center (admin.exchange.microsoft.com)
• Teams Admin Center (admin.teams.microsoft.com)
• Microsoft Graph API

Each of these portals supports a different subset of the five available group types.

Security groups

Security groups (securityEnabled = true, mailEnabled = false) are creatable from:

• The Entra portal
• The Microsoft 365 Admin Center
• The Microsoft Graph API

They are not available from the Exchange Admin Center or Teams Admin Center. This type of group is most commonly used for role assignment, license management, and conditional access policy targeting.

Microsoft 365 groups

Microsoft 365 groups (securityEnabled + mailEnabled = true) are the most versatile and complex in terms of default values. They can be created from nearly all portals, but with different attributes depending on the origin — a point discussed in detail in the next section.

Distribution groups and mail-enabled security groups

Distribution groups (securityEnabled = false, mailEnabled = true) and mail-enabled security groups fall primarily under Exchange messaging. Their creation is available from:

• The Microsoft 365 Admin Center
• The Exchange Admin Center
• The Microsoft Graph API

The Entra portal does not allow their direct creation.

Dynamic groups

Dynamic groups (membership based on attribute rules) are fully supported by the Entra portal and Graph API. The Microsoft 365 Admin Center offers partial support, limited to dynamic security groups. Dynamic Microsoft 365 groups cannot be created there.

The trap of default values for Microsoft 365 groups

It is on this type of group that configuration gaps are most significant and most likely to cause unexpected behavior.

The key difference lies between the Microsoft 365 Admin Center and the Teams portal: a group created when creating a Teams team is assigned securityEnabled = true, whereas the same type of group created from the Microsoft 365 Admin Center will have securityEnabled = false.

This distinction has concrete consequences:

• A group with securityEnabled = false cannot be used to target certain conditional access policies.
• It cannot be used for Azure or Microsoft 365 role assignment.
• Group audit and cleanup campaigns may produce inconsistent results if this parameter is not taken into account.

1# Connect to Microsoft Graph module
2Connect-MgGraph -Scopes "Group.Read.All"
3 
4# Retrieve groups with their securityEnabled and mailEnabled attributes
5Get-MgGroup -All | Select-Object DisplayName, SecurityEnabled, MailEnabled, GroupTypes | Sort-Object DisplayName | Format-Table -AutoSize

To go further and filter only Microsoft 365 groups where securityEnabled is false (potentially misconfigured for your needs):

1# Filter Microsoft 365 groups with securityEnabled = false
2Get-MgGroup -All -Filter "groupTypes/any(c:c eq 'Unified') and securityEnabled eq false" |
3  Select-Object DisplayName, SecurityEnabled, MailEnabled |
4  Sort-Object DisplayName

Why these differences directly impact your governance

In a Zero Trust and Identity First approach, the consistency of directory object configuration is non-negotiable. Heterogeneous groups — created indifferently from Teams, the Admin Center, or the Entra portal — generate a fleet that is difficult to audit and expose the organization to multiple risks:

• Ineffective conditional access policies: a group targeted in a policy may not behave as expected if securityEnabled is false.
• Inconsistent license or role assignment: some assignment scenarios require enabled security groups.
• Compliance audit complexity: an auditor or governance tool like Microsoft Entra ID Governance or Purview may produce incorrect reports if group types are not standardized.
• Enlarged attack surface: misconfigured groups can grant unintended access.

Recommendations for standardizing group creation

Given these divergences, three complementary approaches allow you to regain control.

1. Prioritize the Microsoft Graph API for automation

The Graph API is the only interface that allows you to explicitly define securityEnabled and mailEnabled during creation, without imposed default values. It is therefore ideal for automated and reproducible processes.

Example of creating a Microsoft 365 group with securityEnabled = true via PowerShell and the Microsoft.Graph module:

1# Connect with necessary rights
2Connect-MgGraph -Scopes "Group.ReadWrite.All"
3 
4# Create a Microsoft 365 group with both attributes explicitly defined
5$groupParams = @{
6  DisplayName       = "Team-Project-Alpha"
7  MailNickname      = "team-project-alpha"
8  Description       = "Microsoft 365 group for Project Alpha"
9  GroupTypes        = @("Unified")
10  MailEnabled       = $true
11  SecurityEnabled   = $true
12  Visibility        = "Private"
13}
14 
15New-MgGroup -BodyParameter $groupParams

2. Standardize the reference portal by group type

If your organization is not yet ready to automate all group creations, define at minimum a reference portal for each type:

• Security groups → Entra Portal or PowerShell
• Microsoft 365 groups → Entra Portal (to guarantee securityEnabled = true)
• Distribution groups → Exchange Admin Center
• Dynamic groups → Entra Portal

3. Implement a naming policy and regular audit

The group naming policy in Entra ID (via group settings) allows you to apply prefixes or suffixes that facilitate identification of the group type and origin. Combined with periodic access reviews via Microsoft Entra ID Governance, it constitutes an effective safety net.

1# Check the current naming policy
2Connect-MgGraph -Scopes "Directory.Read.All"
3Get-MgGroupSettingTemplate | Where-Object { $_.DisplayName -eq "Group.Unified" }

Technical references

To deepen the concepts covered in this article, the following official resources are recommended:

• group resource in Microsoft Graph API — Complete reference of available properties and operations.
• Compare groups in Microsoft 365 — Overview of group types and their use cases.
• Manage Entra ID groups — Management guide from the Entra portal.
• Conditional access and groups — Impact of groups in conditional access policies.
• Microsoft.Graph PowerShell module — Documentation of the official PowerShell module for Graph API.

Conclusion: standardize to master your directory

The portal used to create a group in Microsoft 365 and Entra ID directly influences its technical attributes and, consequently, its behavior throughout the entire ecosystem. This reality — often discovered during audits or incidents — justifies a proactive and documented approach to group governance.

IT teams concerned with security and compliance should:

• Audit the existing situation with the PowerShell scripts presented above.
• Standardize creation methods by prioritizing the Microsoft Graph API for automated processes.
• Document the rules in a runbook accessible to all concerned teams.
• Plan regular reviews via Microsoft Entra ID Governance to maintain consistency over time.

It is at this price that you obtain an auditable, consistent directory truly aligned with the principles of Zero Trust.