Group.Create
Export JSON
Export CSV
Copy URL
Print
Application
Read
User Scope
Allows the app to create groups without a signed-in user.
Delegated Access
App-Only Access
Permission Details
Application Permission
Create groups
Allows the app to create groups without a signed-in user.
Permission ID:
bf7b1a76-6e77-406b-b258-bf5c7720e98f
Properties
| Property | Type | Description |
|---|---|---|
id |
string |
The unique identifier for an entity. Read-only. |
nextVersionDefinition |
object |
Definition of the next version of this definition |
classType |
microsoft.graph.groupPolicyDefinitionClassType |
|
lastModifiedDateTime |
date-time |
The date and time the entity was last modified. |
displayName |
stringNullable |
The localized policy name. |
version |
stringNullable |
Setting definition version |
categoryPath |
stringNullable |
The localized full category path for the policy. |
presentations |
microsoft.graph.groupPolicyPresentation collection |
The group policy presentations associated with the definition. |
minUserCspVersion |
stringNullable |
Minimum required CSP version for user configuration in this definition |
category |
object |
The group policy category associated with the definition. |
definitionFile |
object |
The group policy file associated with the definition. |
previousVersionDefinition |
object |
Definition of the previous version of this definition |
groupPolicyCategoryId |
uuid |
The category id of the parent category |
supportedOn |
stringNullable |
Localized string used to specify what operating system or application version is affected by the policy. |
hasRelatedDefinitions |
boolean |
Signifies whether or not there are related definitions to this definition |
Showing 15 of 18 properties. View all on Microsoft Learn →
Relationships
| Relationship | Type | Description |
|---|---|---|
members |
directoryObject collection |
Direct members of this group, who can be users, devices, other groups, or service principals. |
owners |
directoryObject collection |
The owners of the group who can be users or service principals. |
memberOf |
directoryObject collection |
Groups and administrative units that this group is a member of. Read-only. Nullable. |
transitiveMembers |
directoryObject collection |
The direct and transitive members of a group. Nullable. |
transitiveMemberOf |
directoryObject collection |
Groups that this group is a member of, including nested. Read-only. |
drive |
drive |
The group's default drive. Read-only. |
drives |
drive collection |
The group's drives. Read-only. |
sites |
site collection |
The list of SharePoint sites in this group. Access the default site with /sites/root. |
threads |
conversationThread collection |
The group's conversation threads. Nullable. |
conversations |
conversation collection |
The group's conversations. Nullable. |
calendar |
calendar |
The group's calendar. Read-only. |
calendarView |
event collection |
The calendar view for the calendar. Read-only. |
events |
event collection |
The group's calendar events. |
photo |
profilePhoto |
The group's profile photo. |
photos |
profilePhoto collection |
The profile photos owned by the group. Read-only. Nullable. |
team |
team |
The team associated with this group. |
onenote |
onenote |
The group's OneNote notebooks. Read-only. |
planner |
plannerGroup |
Selective Planner services available to the group. Read-only. Nullable. |
Graph Methods
Delegated access
App-only access
Code Examples
C# / .NET SDK
// Install: dotnet add package Microsoft.Graph
// Install: dotnet add package Azure.Identity
using Microsoft.Graph;
using Azure.Identity;
// Application permissions - daemon/service app
var tenantId = "YOUR_TENANT_ID";
var clientId = "YOUR_CLIENT_ID";
var clientSecret = "YOUR_CLIENT_SECRET";
var credential = new ClientSecretCredential(tenantId, clientId, clientSecret);
var graphClient = new GraphServiceClient(credential);
// Example: GET /users/{user-id}
var users = await graphClient.Users.GetAsync();
foreach (var user in users?.Value ?? [])
{
Console.WriteLine($"User: {user.DisplayName}");
}
JavaScript / TypeScript
// npm install @azure/msal-browser @microsoft/microsoft-graph-client
import { PublicClientApplication } from "@azure/msal-browser";
import { Client } from "@microsoft/microsoft-graph-client";
import { AuthCodeMSALBrowserAuthenticationProvider } from
"@microsoft/microsoft-graph-client/authProviders/authCodeMsalBrowser";
const msalConfig = {
auth: {
clientId: "YOUR_CLIENT_ID",
authority: "https://login.microsoftonline.com/YOUR_TENANT_ID"
}
};
const pca = new PublicClientApplication(msalConfig);
await pca.initialize();
// Application: Use client credentials (Node.js backend only)
// npm install @azure/identity @microsoft/microsoft-graph-client
import { ClientSecretCredential } from "@azure/identity";
import { TokenCredentialAuthenticationProvider } from
"@microsoft/microsoft-graph-client/authProviders/azureTokenCredentials";
const credential = new ClientSecretCredential(
"YOUR_TENANT_ID",
"YOUR_CLIENT_ID",
"YOUR_CLIENT_SECRET"
);
const authProvider = new TokenCredentialAuthenticationProvider(credential, {
scopes: ["https://graph.microsoft.com/.default"]
});
const graphClient = Client.initWithMiddleware({ authProvider });
const result = await graphClient.api("/users").get();
console.log(result);
PowerShell
# Install Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser
# Application access with certificate
$params = @{
ClientId = "YOUR_CLIENT_ID"
TenantId = "YOUR_TENANT_ID"
CertificateThumbprint = "YOUR_CERT_THUMBPRINT"
}
Connect-MgGraph @params
# Or with client secret (not recommended for production)
# Connect-MgGraph -ClientSecretCredential $credential
# Example: GET /users
$result = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/users"
$result | ConvertTo-Json -Depth 5
# Always disconnect when done
Disconnect-MgGraph
Python
# pip install msgraph-sdk azure-identity
from azure.identity import InteractiveBrowserCredential, ClientSecretCredential
from msgraph import GraphServiceClient
import asyncio
# Application permissions - client credentials
credential = ClientSecretCredential(
tenant_id="YOUR_TENANT_ID",
client_id="YOUR_CLIENT_ID",
client_secret="YOUR_CLIENT_SECRET"
)
scopes = ["https://graph.microsoft.com/.default"]
client = GraphServiceClient(credential, scopes)
async def get_users():
# Example: GET /users
result = await client.users.get()
for user in result.value:
print(f"User: {user.display_name}")
return result
asyncio.run(get_users())
App Registration
1
Navigate to Azure Portal
Go to App registrations in Microsoft Entra admin center
2
Add API Permission
Select your app → API permissions → Add a permission → Microsoft Graph
3
Select Permission Type
Choose Application permissions and search for Group.Create
4
Grant Admin Consent
Application permissions always require admin consent. Click "Grant admin consent" in the Azure portal.