5.3 Managing Microsoft 365 Groups & Shared Mailboxes

Microsoft 365 Groups — The Foundational Collaboration Object

A Microsoft 365 Group is the group type that powers Microsoft 365 collaboration workloads. Creating one M365 Group provisions a bundle of resources in a single operation:

• A shared mailbox with a group email address (team@contoso.com) and a group calendar
• A SharePoint team site with document library and pages
• A Planner plan for task management
• A OneNote notebook tied to the SharePoint site
• (Optionally) a Microsoft Team when a user promotes the group to a Team

This is the key contrast with the other group types: an M365 Group is not just a mail recipient or a permission container — it is a workload bundle.

Creating and Managing M365 Groups

Create from M365 admin center → Teams & groups → Active teams and groups → Add a group, or from any workload that consumes them (Outlook, Teams, SharePoint, Planner). Core configuration:

• Group email and display name (subject to the naming policy — prefixes/suffixes and blocked words enforced at create time)
• Privacy: Public (anyone in the tenant can join and read content) or Private (owner approval required to join; content visible only to members)
• Classification (optional labels like Confidential, Internal — configured in Entra via group classification settings)
• Owners (at least one) and Members
• Guest access toggle — whether external B2B guests can be added to the group

Owner-Managed vs Assigned Membership

By default an M365 Group is owner-managed: members can join/leave on their own for Public groups, and owners add or approve members for Private groups. Switching a group to Assigned membership (Private only) removes self-service join — members are explicitly assigned by an owner or admin. Dynamic membership (below) is a third mode.

Dynamic Membership via Entra Dynamic Group Rules

A dynamic group evaluates Entra attribute rules and automatically adds or removes members as attributes change. Example rule for a Sales M365 Group:

  user.department -eq "Sales" -and user.userType -eq "Member"

When a user's department changes to Sales in Entra ID, they are added automatically; when it changes away, they are removed. Rules support string, enumeration, and multi-value attributes (-any/-all operators). Membership processing is asynchronous — typically minutes, not real-time.

License note: Dynamic membership requires a Microsoft Entra ID P1 license for every unique user who is a member of one or more dynamic groups — the same rule for security groups and Microsoft 365 Groups. You do not have to assign a license to each of those users individually, but the tenant must hold enough P1 licenses to cover them all. There is no separate P2 tier for "advanced" rules, and the requirement is not tied to the administrator who authors the rule.

Group Governance Policies

• Naming policy — prefix/suffix (e.g., GRP- prefix) and blocked words; enforced in all group creation surfaces including Outlook and Teams
• Expiration policy — a group with no activity in the interval (e.g., 180 days) expires unless an owner renews it; owners are emailed 30 days, 15 days, and 1 day before expiration, and the group is deleted one day after the expiration date. Groups with recent activity are auto-renewed roughly 35 days before expiry and generate no notification at all. Requires Entra ID P1 for group members
• Classification labels — Confidential/Internal/Public labels drive default guest-access and external-sharing behavior via PowerShell mapping
• Guest access per group — a per-group toggle; tenant-wide external collaboration policy is the outer boundary

---

Other Group Types in Entra and Exchange

Exam distinction: Security groups are the only group type used to assign licenses to a group of users (group-based licensing in Entra). Distribution lists and Mail-enabled security groups are mail recipients. M365 Groups are workload bundles. Do not conflate them.

Dynamic vs Assigned Membership

Applies to Security groups and M365 Groups:

• Assigned — members are explicitly added and removed by an owner/admin; no rule evaluation
• Dynamic — membership is derived from an attribute rule; owners cannot manually add or remove members

A group is one or the other — you cannot mix assigned and dynamic members in the same group. Switching types requires removing all members first.

---

Shared Mailboxes

A shared mailbox is a single Exchange mailbox that multiple users can open and use. It has its own email address (info@contoso.com, support@contoso.com) but no dedicated owner identity — users access it by delegation using their own credentials.

Why Use a Shared Mailbox

• Generic addresses (info@, sales@, billing@) that several staff answer
• A mailbox that survives staff turnover without ownership transfer
• A mailbox that does not consume a license up to a documented limit

Licensing: The 50 GB Rule

A shared mailbox does not require a separate Exchange Online license as long as:

1. Its mailbox size stays at or under 50 GB (the default shared mailbox quota), AND
2. No In-Place Archive, retention policy, or legal hold is enabled on it

If either condition is broken, the shared mailbox must be licensed with Exchange Online Plan 2 (or Plan 1 plus the Exchange Online Archiving add-on). This is the single most tested licensing fact about shared mailboxes.

Practical note: A shared mailbox must still be enabled by an admin and have at least one delegate mapped, otherwise it sits idle. It does not have its own password and cannot be signed in to directly.

Creating a Shared Mailbox and Delegating Access

Create via M365 admin center → Teams & groups → Shared mailboxes → Add a mailbox or Exchange admin center → Recipients → Shared → New. Then map delegates with three permission layers:

Full Access is the read-and-manage permission. Send As and Send on Behalf are independent send permissions — choose one depending on whether the recipient should see the delegate's name.

Converting User Mailbox ↔ Shared Mailbox

When an employee leaves and you want to keep their mailbox as a shared resource:

1. Block sign-in on the user account (preserves the mailbox)
2. Remove the user's license (frees the seat; mailbox becomes unlicensed but remains for 30 days)
3. Convert the mailbox to shared in the Exchange admin center (Recipient → Convert → To shared mailbox)
4. Apply a Plan 2 license only if you exceed 50 GB or enable archive/retention

The reverse — shared mailbox back to user mailbox — is supported but requires that a licensed user account be attached, because a user mailbox must have an identity to sign in.

---

Putting It Together

For MS-102, the mental model is: M365 Groups bundle workloads, security groups bundle permissions and licenses, distribution lists and mail-enabled security groups bundle mail recipients, and shared mailboxes bundle delegates around one address. Pick the group type by the workload you need (collaboration vs permission vs mail-only), pick shared mailbox when the goal is shared ownership of a generic address, and always check the 50 GB / archive licensing trigger before assuming a shared mailbox is free.