> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Group Membership
> Adds a user to a group, or removes them from it, in your client's Microsoft 365, or in Active Directory for an AD-synced group.
Group Membership adds one user to a group, or removes them from it. It works with security, Microsoft 365, distribution and mail-enabled security groups. Use it when someone changes team or needs the access a group gives. It needs [Microsoft 365 connected](/core/get-started/connect-microsoft-365), [Exchange access](/core/reference/microsoft-faq#exchange-online) for distribution and mail-enabled security groups, and the [desktop agent](/desktop-agent/overview) for groups synced from on-premises Active Directory. Under GDAP, the client's relationship needs Groups Administrator, or another role that can change group members (see [Recommended roles](/integrations/microsoft-graph/recommended-roles)).
## What the form asks
| Field | |
| - | - |
| Group | Required, always on. One group, picked from all of the client's groups |
| User | Required, always on. The person to add or remove, picked from the client's users |
| Action | Required, always on. Add to group or Remove from group |
| Reason / ticket reference | Optional by default. For your records and the approver; not sent to Microsoft |
## What it does
1. Creates a ticket in your PSA, if Ticketing is on.
2. Waits for approval, if Approval is Internal or External, or a conditional override matches.
3. Add To Group or Remove From Group, as the form says, in the client's Microsoft 365:
* Security and Microsoft 365 groups change in Microsoft Entra ID.
* Distribution and mail-enabled security groups change in Exchange Online.
Adding someone who's already a member, or removing someone who isn't, completes without an error. In Executions, open the step to see the group and its type.
On a client set to Cloud + On-Prem (synced), a group synced from Active Directory takes Set On-Prem Group Membership instead: the desktop agent adds or removes the user in Active Directory, then starts a delta sync if it runs on the Microsoft Entra Connect server. The user must be synced from Active Directory too. Cloud groups on that client change in Microsoft 365. If the Active Directory change fails, the run ends Failed, and with Ticketing on the ticket gets a note to update the group in AD by hand.
With Log actions to the ticket on, the ticket also gets a note when the run starts, after Add To Group or Remove From Group (for example "Added [jane.doe@acme.com](mailto:jane.doe@acme.com) to 'Sales Team' (security)") and when the run completes.
## Configure it
Go to **Config**, choose Groups and click Group Membership.
| Setting | Where | What it does |
| - | - | - |
| Availability | Header | Internal only, Public form only, Internal + public or Disabled. List on homepage needs a public form. Base config only |
| Group, User, Action | Form config | Always on: the automation needs them |
| Reason / ticket reference | Form config | Hidden, Optional or Required. Can differ per client |
| Add field, Add section | Form config | Your own questions. They're saved with the request and can go in ticket templates, but aren't sent to Microsoft. Add client section asks one client only |
| Approval | Execution config | None runs on submit. Internal waits for a teammate or group; External waits for the client's approver, set on each client. Conditional overrides use a different approval when the answers match, for example when Action is Remove from group |
| Ticketing | Execution config | Create a PSA ticket for each run, with its type, priority, status, subject and body. Log actions to the ticket adds an internal or public note as each action completes |
| User directory filters | Execution config | Which users the User picker lists: licensed, active, no guests, and not in the Entra roles you exclude. Exclude specific users at a client's scope. The Group picker always lists all of the client's groups |
Approval, Ticketing and User directory filters are set on Base config and apply to every client unless you override them for one. For how Base config and client overrides work, see [How configuration works](/core/get-started/configure-user-onboarding#settings-for-each-client).
## Troubleshooting
The run form warns you before you submit. Under GDAP, assign Groups Administrator (or User Administrator) to Triggr's security group in the client's relationship, then click **Check now** on the client's GDAP health.
The group comes from on-premises Active Directory, so only users synced from Active Directory can join it. Use a cloud group for that user.
Distribution and mail-enabled security groups change in Exchange Online, and the client has no Exchange connection in Triggr yet. See [Exchange Online](/core/reference/microsoft-faq#exchange-online).
Microsoft sets a dynamic group's members from its membership rule, so nobody can add or remove them directly. Change the rule, or the user's details it matches, in the Microsoft Entra admin center.
## Related
* [Workflow catalogue](/core/reference/workflow-catalogue)
* [Run a workflow](/core/use/run-a-workflow)
* [Executions](/core/use/executions)
* [User Onboarding](/core/workflows/user-onboarding), which adds a new starter to groups
* [User Offboarding](/core/workflows/user-offboarding), which can remove a leaver from all their groups
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.