Entra security groups as access profiles in your IAM tool

Already using security groups in Entra ID for SharePoint permissions? You can use those groups one-to-one as AccessProfiles — no duplicate work required.

If you're using M365 properly, you already have security groups — per role, per project, per team. You can put those groups to work directly as RBAC roles in your access management tool.

The pattern

1. Your AccessGuard tool connects to Entra via OAuth (delegated User.Read.All + Directory.Read.All).
2. The tool pulls security groups nightly.
3. Each group becomes an AccessProfile.
4. Members of the group become members of the profile.
5. Changes in Entra → next sync → automatically processed in AG.

Which groups work well?

• Role groups ("Sales Team", "Engineering", "HR").
• Security groups for SharePoint sites.
• Conditional Access target groups.

Not suitable

• M365 Groups (these are for Teams membership, not for IAM).
• Dynamic groups with complex rules — for IAM, explicit membership is preferred.
• Groups containing guests (those belong in a separate guest review).

Apply to members

Link each AccessProfile to the systems and items that belong to it. With a single click of "apply", every member of the group is added to systems X, Y, and Z with the correct state. See birthright access for how to combine this.

See also: M365 pillar, RBAC.