> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Bulk Add / Remove Users to Group
> Adds several users to one group, or removes them from it, in one run in your client's Microsoft 365, or in Active Directory for an AD-synced group.
Bulk Add / Remove Users to Group adds several people to one group, or removes them from it, in one run. It works with security, Microsoft 365, distribution and mail-enabled security groups. To change one person's membership, use [Group Membership](/core/workflows/group-membership) instead. It needs [Microsoft 365 connected](/core/get-started/connect-microsoft-365), [Exchange access](/core/reference/microsoft-faq#exchange-online) for distribution and mail-enabled security groups, and the [desktop agent](/desktop-agent/overview) for groups synced from on-premises Active Directory. Under GDAP, the client's relationship needs Groups Administrator, or another role that can change group members (see [Recommended roles](/integrations/microsoft-graph/recommended-roles)).
## What the form asks
| Field | |
| - | - |
| Group | Required, always on. One group, picked from all of the client's groups |
| Action | Required by default. Add or Remove. If it's hidden or left blank, the run adds |
| Users | Required by default. Add each person from the client's users, filtered by User directory filters |
| Reason / ticket reference | Optional by default. For your records and the approver; not sent to Microsoft |
## What it does
1. Creates one PSA ticket for the run, if Ticketing is on.
2. Waits for approval, if Approval is Internal or External, or a conditional override matches.
3. Add To Group or Remove From Group, for each user in turn, in the client's Microsoft 365:
* Security and Microsoft 365 groups change in Microsoft Entra ID.
* Distribution and mail-enabled security groups change in Exchange Online.
It's one run for everyone. If the change fails for a user, the run stops there: the users before them are already changed, the users after them aren't, and Executions shows where it stopped. Adding someone who's already a member, or removing someone who isn't, completes without an error.
On a client set to Cloud + On-Prem (synced), a group synced from Active Directory takes Set On-Prem Group Membership instead: the desktop agent adds or removes all the users in Active Directory in one go, then starts a delta sync if it runs on the Microsoft Entra Connect server. Every user must be synced from Active Directory too. If the change fails for any of them, the others are still changed, the run ends Failed, and with Ticketing on the ticket gets a note saying how many failed, to update in AD by hand. Cloud groups on that client change in Microsoft 365.
With Log actions to the ticket on, the ticket also gets a note when the run starts, after each Add To Group or Remove From Group (for example "Added [jane.doe@acme.com](mailto:jane.doe@acme.com) to 'Sales Team' (security)") and when the run completes.
## Configure it
Go to **Config**, choose Groups and click Bulk Add / Remove Users to Group.
| Setting | Where | What it does |
| - | - | - |
| Availability | Header | Internal only, Public form only, Internal + public or Disabled. List on homepage needs a public form. Base config only |
| Group | Form config | Always on: the automation needs it |
| Action, Users, Reason / ticket reference | Form config | Hidden, Optional or Required for each. Hide Action and every run adds. Keep Users required. Can differ per client |
| Add field, Add section | Form config | Your own questions. They're saved with the request and can go in ticket templates, but aren't sent to Microsoft. Add client section asks one client only |
| Approval | Execution config | None runs on submit. Internal waits for a teammate or group; External waits for the client's approver, set on each client. Conditional overrides use a different approval when the answers match, for example when Action is Remove. Let the approver edit the request lets them correct the answers first |
| Ticketing | Execution config | Create one PSA ticket for each run, with its type, priority, status, subject and body. Log actions to the ticket adds an internal or public note as each action completes |
| User directory filters | Execution config | Which users the Users picker lists: licensed, active, no guests, and not in the Entra roles you exclude. Exclude specific users at a client's scope. The Group picker always lists all of the client's groups |
Approval, Ticketing and User directory filters are set on Base config and apply to every client unless you override them for one. For how Base config and client overrides work, see [How configuration works](/core/get-started/configure-user-onboarding#settings-for-each-client).
## Troubleshooting
Check User directory filters. Licensed users only hides people with no licence, and Active users only hides accounts whose sign-in is blocked; untick them on Base config or for that client.
The run form warns you before you submit. Under GDAP, assign Groups Administrator (or User Administrator) to Triggr's security group in the client's relationship, then click **Check now** on the client's GDAP health.
The group comes from on-premises Active Directory, so only users synced from Active Directory can join it. Nothing was submitted. Leave those users out, or use a cloud group for them.
Distribution and mail-enabled security groups change in Exchange Online, and the client has no Exchange connection in Triggr yet. See [Exchange Online](/core/reference/microsoft-faq#exchange-online).
## Related
* [Workflow catalogue](/core/reference/workflow-catalogue)
* [Run a workflow](/core/use/run-a-workflow)
* [Executions](/core/use/executions)
* [Group Membership](/core/workflows/group-membership), to add or remove one person
* [Create Group](/core/workflows/create-group), to make the group first
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.