'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Azure AD Security Groups Not Showing for Sensitivity Labels in Microsoft 365
Question details
Administrators cannot select Azure Active Directory security groups when attempting to assign permissions for Microsoft Purview sensitivity labels.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Assigning Microsoft Purview sensitivity label permissions to organizational groups for data protection and compliance.
- Observed behavior
- Azure AD security groups do not appear in the permissions list, preventing administrators from selecting them, while users and distribution groups are visible.
Ensure you have global administrator or compliance administrator permissions in Microsoft 365, and verify your tenant has an active Azure AD Premium P1 or P2 license.
Recreate the Security Group as a Mail-Enabled Microsoft 365 Group
Since standard Azure AD security groups may not be supported for sensitivity label permissions, replacing them with a mail-enabled Microsoft 365 group is the recommended workaround.
Microsoft Purview often requires mail-enabled groups to correctly process and assign sensitivity label permissions. Standard Azure AD security groups lack this capability, causing them to be hidden from the selection UI.
Log in to the Microsoft 365 admin center using your administrator credentials.
On the left sidebar, click on 'Teams & groups' and select 'Active teams and groups'.
Click 'Add a group' and choose 'Microsoft 365' as the group type to ensure it is mail-enabled.
Complete the group setup wizard. If your previous security group used dynamic rules, apply the same dynamic membership query to this new group.
Return to the Microsoft Purview compliance portal. You will now be able to search for and select the newly created Microsoft 365 group to assign the sensitivity label permissions.
Verify Azure AD Licensing and Contact Microsoft Support
If the newly created Microsoft 365 group still does not appear, check for missing licenses or backend synchronization delays.
Manage Your Documents Securely with WPS Office
While Microsoft 365 offers complex enterprise compliance tools like Purview sensitivity labels, WPS Office provides a lightweight, highly compatible, and free alternative for everyday document creation and local file encryption without the administrative overhead.
- 1. Download WPS Office: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Open Your Document: Launch WPS Office and open your Word, Excel, or PowerPoint files with perfect formatting compatibility.
- 3. Encrypt for Security: Go to the 'Menu', select 'Document Encryption', and set a secure password to protect your sensitive files locally.
Frequently Asked Questions
Why can't I see my Azure AD security group when assigning sensitivity labels?
Microsoft Purview sensitivity label permissions primarily support users, distribution groups, and mail-enabled Microsoft 365 groups. Standard Azure AD security groups do not have the necessary mail-enabled properties and are therefore unsupported in this specific permissions interface.
Do I need a specific license to use dynamic Microsoft 365 groups?
Yes, utilizing dynamic membership queries for Microsoft 365 groups requires your tenant to have an active Azure AD Premium P1 or P2 license.
How long does it take for a new Microsoft 365 group to appear in Purview?
It typically takes a few minutes for a newly created group to become visible. However, in some cases of high server load, it can take up to a few hours for backend synchronization to complete.
