Group nesting

How nesting works in Entra ID#

A group's members can include users, devices, service principals, contacts, and other groups. When group B is a member of group A, every member of B is treated as a member of A for most access evaluations, and this applies recursively through further levels.

Nesting is how large organizations avoid managing the same people in many places: departmental groups nest into divisional groups, which nest into company-wide groups, and access is granted once at the level where it belongs.

Where nesting goes wrong#

The same mechanism that makes nesting efficient makes it opaque. Common failure modes:

• Circular references, where a nesting chain loops back on itself.
• Runaway depth, where chains grow past the point anyone can reason about them.
• The licensing mismatch, where nesting a group under a licensed parent looks like it licenses the members and, per Microsoft rules, does not.
• Membership sprawl, where users transitively accumulate hundreds of effective memberships.

Important limits#

Not every Microsoft 365 feature honors nesting the same way. Some workloads evaluate only direct membership for certain scenarios, which is another reason the actual structure needs to be visible: whether nesting works as intended depends on where it is used.