Skip to main content
Group Membership adds one user to a group, or removes them from it. It works with security, Microsoft 365, distribution and mail-enabled security groups. Use it when someone changes team or needs the access a group gives. It needs Microsoft 365 connected, Exchange access for distribution and mail-enabled security groups, and the desktop agent for groups synced from on-premises Active Directory. Under GDAP, the client’s relationship needs Groups Administrator, or another role that can change group members (see Recommended roles).

Group Membership in 49 seconds: what it asks, what it does and what you get.

​
What the form asks

​
What it does

  1. Creates a ticket in your PSA, if Ticketing is on.
  2. Waits for approval, if Approval is Internal or External, or a conditional override matches.
  3. Add To Group or Remove From Group, as the form says, in the client’s Microsoft 365:
    • Security and Microsoft 365 groups change in Microsoft Entra ID.
    • Distribution and mail-enabled security groups change in Exchange Online.
Adding someone who’s already a member, or removing someone who isn’t, completes without an error. In Executions, open the step to see the group and its type. On a client set to Cloud + On-Prem (synced), a group synced from Active Directory takes Set On-Prem Group Membership instead: the desktop agent adds or removes the user in Active Directory, then starts a delta sync if it runs on the Microsoft Entra Connect server. The user must be synced from Active Directory too. Cloud groups on that client change in Microsoft 365. If the Active Directory change fails, the run ends Failed, and with Ticketing on the ticket gets a note to update the group in AD by hand. With Log actions to the ticket on, the ticket also gets a note when the run starts, after Add To Group or Remove From Group (for example “Added jane.doe@acme.com to ‘Sales Team’ (security)”) and when the run completes.

​
Configure it

Go to Config, choose Groups and click Group Membership.

Configure Group Membership: every option, step by step (1:25).

Approval, Ticketing and User directory filters are set on Base config and apply to every client unless you override them for one. For how Base config and client overrides work, see How configuration works.

​
Troubleshooting

The run form warns you before you submit. Under GDAP, assign Groups Administrator (or User Administrator) to Triggr’s security group in the client’s relationship, then click Check now on the client’s GDAP health.
The group comes from on-premises Active Directory, so only users synced from Active Directory can join it. Use a cloud group for that user.
Distribution and mail-enabled security groups change in Exchange Online, and the client has no Exchange connection in Triggr yet. See Exchange Online.
Microsoft sets a dynamic group’s members from its membership rule, so nobody can add or remove them directly. Change the rule, or the user’s details it matches, in the Microsoft Entra admin center.