Mail Enabled Security Groups

What are Mail Enabled Security Groups?

A Mail Enabled Security Group is a hybrid Microsoft 365 group type that combines:

• ✅ Security functionality (used for permission assignments)
• ✅ Email distribution capability (used to send emails to multiple members)

A Mail Enabled Security Group can be used to assign permissions to resources AND receive emails like a distribution list. Unlike standard Security Groups (which are not mail-enabled) or Distribution Groups (which cannot assign permissions), Mail Enabled Security Groups provide both capabilities in one object.

They are created and managed primarily through Exchange Online.

Why Use Mail Enabled Security Groups?

Mail Enabled Security Groups are useful when you need both access control and email communication for the same set of users.

Common Use Cases

1. Assign Permissions to Shared Resources
• SharePoint site access
• OneDrive access
• File share permissions
• Azure AD app permissions
2. Send Emails to All Members
• HR announcements
• IT alerts
• Department-wide communication
3. Simplify Administration

Instead of managing:

• A Security Group for access
• A Distribution List for emails

You manage one single group.

Prerequisites

Mail Enabled Security Groups are created and managed using Exchange Online PowerShell.

Step 1: Install Exchange Online PowerShell Module

If not already installed:

Install-Module ExchangeOnlineManagement -Scope CurrentUser

If already installed:

Update-Module ExchangeOnlineManagement

Step 2: Connect to Exchange Online

Connect-ExchangeOnline

You will be prompted to sign in.

Required Permissions

To create Mail Enabled Security Groups, you must have one of the following roles:

• Exchange Administrator
• Global Administrator
• Recipient Management role

Without proper permissions, the New-DistributionGroup cmdlet will fail.

How to Use Mail Enabled Security Groups?

After creation, Mail Enabled Security Groups can be used for:

✔ Assigning Permissions

Example:

• Add the group to SharePoint site permissions
• Assign as members of another Azure AD role
• Grant access to shared mailboxes

✔ Sending Emails

Send email to: hrdepartment@domain.com
All members will receive the message.

Managing Members

Add a member:

Add-DistributionGroupMember -Identity "HR Department" -Member user@domain.com

Remove a member:

Remove-DistributionGroupMember -Identity "HR Department" -Member user@domain.com

View group details:

Get-DistributionGroup "HR Department"

Mail Enabled Security Group Creation Examples

Example 1: Creating Mail Enabled Security Groups Individually

This example creates a Mail Enabled Security Group and assigns owners and members at creation time.

$Owners = @('owner1@domain.com', 'owner2@domain.com')
$Members = @('member1@domain.com', 'member2@domain.com')
New-DistributionGroup -Name "HR Department" `
-Alias "hrdepartment" `-
Type "Security" `
-ManagedBy $Owners `
-Members $Members
                                        

What This Does:

• Creates a mail-enabled security group named HR Department
• Sets alias as hrdepartment
• Makes it a Security type
• Assigns two owners
• Adds initial members

Example 2: Bulk Create Mail Enabled Security Groups

Bulk creation is ideal when onboarding multiple departments or restructuring.

Sample CSV Structure (MailEnabledSecurityGroups.csv)

                                          
Name,Alias
HR Department,hrdepartment
Finance Team,financeteam
IT Support,itsupport

PowerShell Script

                                            
# Import the CSV file
$groups = Import-Csv -Path "MailEnabledSecurityGroups.csv"

# Create each mail-enabled security group
foreach ($group in $groups) {
    try {
        New-DistributionGroup -Name $group.Name `
        -Alias $group.Alias `
        -PrimarySmtpAddress "$($group.Alias)@7xh7fj.onmicrosoft.com" `
        -Type Security

        Write-Host "✅ Created: $($group.Name)" -ForegroundColor Green
    } catch {
        Write-Host "❌ Failed: $($group.Name)" -ForegroundColor Red
        Write-Host $_.Exception.Message
    }
}
                                            
                                        

What This Script Does

• Reads group details from CSV
• Creates each Mail Enabled Security Group
• Assigns a primary SMTP address
• Displays success or failure message
• Handles errors gracefully

Important Notes

• Mail Enabled Security Groups are created via Exchange Online, not via New-MgGroup.
• They appear in:
• Exchange Admin Center
• Microsoft 365 Admin Center
• Entra ID (as Security + Mail enabled object)
• You cannot convert a normal Security Group directly to Mail Enabled Security without recreation in most scenarios.
• Best practice: Define naming standards before bulk creation.

Comparing Different Types of Microsoft 365 Groups

This table increases your chances of getting featured snippets.

Feature	Security Group	Distribution Group	Mail Enabled Security Group	Microsoft 365 Group
Used for Permissions	✅ Yes	❌ No	✅ Yes	✅ Yes
Can Receive Emails	❌ No	✅ Yes	✅ Yes	✅ Yes
Has Shared Mailbox	❌ No	❌ No	❌ No	✅ Yes
Has Teams Integration	❌ No	❌ No	❌ No	✅ Yes
Managed via Exchange	❌ No	✅ Yes	✅ Yes	❌ No
Best For	Access Control	Email Communication	Access + Email	Collaboration

Summary

Mail Enabled Security Groups are a powerful hybrid group type in Microsoft 365 that:

• ✔ Combine security + email functionality
• ✔ Simplify access management
• ✔ Reduce administrative overhead
• ✔ Improve communication structure

They are ideal for departments, project teams, and functional units that require both permission control and centralized communication.