Entra ID's two principal group types serve different jobs: security groups control access to resources, while Microsoft 365 groups provision collaboration workloads like a shared mailbox, SharePoint site, and Teams team. Their structural behavior differs in ways that matter for hierarchy design.
The practical differences#
The distinctions that affect structure and licensing:
- Nesting: security groups nest into other groups; Microsoft 365 groups have significant restrictions on containing nested groups.
- Purpose coupling: deleting a Microsoft 365 group deletes its attached workloads, so cleanup carries different risk.
- Licensing: group-based licensing works with security groups, which is where license hierarchies are built.
- Creation: Microsoft 365 groups are often user-creatable by default, which is a major source of sprawl.
Why the mix gets messy#
Real tenants contain both types plus distribution groups and mail-enabled security groups, created across years by different tools. Reasoning about access requires knowing which type each node is, because the same-looking membership edge behaves differently by type.
VisualizerEngine
Group types in VisualizerEngine
The hierarchy shows your groups as they actually relate, with members typed correctly during sync. Structural search queries across groups, users, and memberships, and saved searches keep type-specific reviews, like license assignments outside the intended hierarchy, repeatable.