Create a Security-Enabled Distribution Group


Applies to: Office 365 for professionals and small businesses, Office 365 for enterprises, Live@edu

Topic Last Modified: 2010-05-25

When you create a distribution group in the Exchange Control Panel, you can make it a security-enabled distribution group or a security group.

What can you do with security groups?

Distribution groups are typically used so lots of users can receive e-mail sent to a single e-mail address. The primary purpose of a security group is to assign permissions to a large group of users instead of assigning permissions to individual users one at a time. If you're a Microsoft Online e-mail organization, use security groups if you need to assign users permissions to resources in other hosted online services such as Microsoft SharePoint Online.

In your cloud-based e-mail organization, we recommended the following methods to assign users permissions:

  • Use role groups to assign administrative permissions, such as resetting passwords or managing users' options.

  • Use role assignment policies to assign RBAC roles to users. For example, use role assignment policies to give users permissions to create distribution groups or change their display name.

Create a security group using the Exchange Control Panel

  1. Select Manage My Organization > Users & Groups > Distribution Groups > New.

  2. Specify a display name and e-mail address.

  3. Select the Make this group a security group check box.

  4. Click Save to create the new group.

After you create a security group, the membership is closed. When membership is closed, only group owners can add members to the security group, or owners have to approve requests to join the group. Additionally, only group owners can remove members from the security group.

Identify the security groups in your cloud-based e-mail organization

Security groups aren't identified in the list of Distribution Groups in the Exchange Control Panel. To help identify your security groups, add a prefix or suffix to the security group's display name. For example, you could add the prefix, "SG_" to the display name so you can easily identify security groups in the Exchange Control Panel.

Another way to identify security groups is to use Windows PowerShell and run the following command:

Get-DistributionGroup -Filter '(GroupType -eq "Universal,SecurityEnabled")'
Next steps

After you create a security group, you can add or remove members, hide it from the shared address book, or control who can send e-mail to the group by selecting the group from the Groups list, and clicking Details. For more information, see Change Distribution Group Properties.

Related help topics
No resources were found.