To create Microsoft 365 groups, you can use the New-UnifiedGroup cmdlet from the Exchange Online for PowerShell (EXOv2) module.

Connect to your tenant:

Connect-ExchangeOnline

In order to create a new M365 group, run this command:

New-UnifiedGroup -DisplayName "HQ IT Department" -Alias "it-dept" -EmailAddresses [email protected] -AccessType Private

M365 has two types of groups:

• Public – an open group. Any user can join the group and access its contents;
• Private – only group members have access. The owner of the group or an Azure admin can add a user to a private group.

To add users or owners to the group, use the Add-UnifiedGroupLinks cmdlet. Let’s add a user to the group and assign it as the owner:

Add-UnifiedGroupLinks –Identity it-dept –LinkType Members –Links DiegoF
Add-UnifiedGroupLinks –Identity it-dept –LinkType Owners –Links DiegoF

You can add a subscriber to the group. A subscriber will receive email notifications:
Add-UnifiedGroupLinks –Identity it-dept –LinkType Subscribers –Links AlexW

If you want to add multiple users to a Microsoft 365 group at once, you can import a list of users from a CSV file:

Import-CSV "C:\PS\Data\add_m365_members.csv" | ForEach-Object {
Add-UnifiedGroupLinks –Identity it-dept –LinkType Members?–Links $_.member
}

To display all users in a group:

Get-UnifiedGroupLinks –Identity it-dept –LinkType Members

To show group owners:

Get-UnifiedGroupLinks –Identity it-dept –LinkType Owners

You can hide the M365 group from the Global Address List (GAL):

Set-UnifiedGroup -Identity it-dept -HiddenFromAddressListsEnabled $true

Create and Manage Dynamic Groups with Azure AD PowerShell

You can create a dynamic group of users or devices in Azure AD. The members are added to the group dynamically based on Azure user attributes. Dynamic membership is supported for both Azure security and Microsoft 365 groups. To create dynamic groups, use the New-AzureADMSGroup cmdlet from AzureAD module.

For example, you can create a dynamic group that includes all users from Munich (user.city -eq "Munich") with the specific job position (user.jobTitle -like "*Engineer*"). Let’s create a dynamic Azure security group for this example:

New-AzureADMSGroup -Description "mun_engineers" -DisplayName "All Munich IT dept engineers (dynamic)" -MailEnabled $false -SecurityEnabled $true -MailNickname mun_engineers -GroupTypes "DynamicMembership" -MembershipRule "(user.city -eq ""Munich"" -and user.jobTitle -contains ""Engineer"")" -MembershipRuleProcessingState "On"

New-AzureADMSGroup : A parameter cannot be found that matches parameter name 'MembershipRule'.

To create a dynamic Microsoft 365 group, specify Unified as a group type:

New-AzureADMSGroup -DisplayName "M365 Admins" -Description "Dynamic Microsoft 365 Group for tenant admins" -MailEnabled $True -SecurityEnabled $True -MailNickname M365GAdmins -GroupTypes "DynamicMembership", "Unified" -MembershipRule "(User.department -eq ""IT"")" -MembershipRuleProcessingState "On"

Membership in the Azure dynamic groups in an organization is updated when any user or device properties are changed. If you make bulk changes to AD, import many users, or change group/user architecture, it is recommended to suspend automatic update of dynamic groups for some time:

$dynGroupObj = Get-AzureADMSGroup -SearchString “All Munich IT dept engineers (dynamic)”
Set-AzureADMSGroup -Id $dynGroupObj.id -MembershipRuleProcessingState "Paused"

To enable rule processing for a dynamic group, run the command below:

Set-AzureADMSGroup -Id $dynGroupObj.id -MembershipRuleProcessingState "On"

The table below shows user attributes you can use to build queries for Azure dynamic groups.