Instead of building a user query, you can scope a sync policy to one or more Microsoft Entra ID security groups. Every member of the selected groups is included in the policy, and changes to group membership in Entra ID are picked up automatically. This article covers what you need in place, how to add groups to a policy, and what to expect once the policy is running.
A policy selects users either with the Query builder or with Groups, not both. Switching between the two clears the other method's settings when you save. To match users by department, job title or employee type, see Defining user selection rules instead.
Before you start
Security group selection reads group membership from your Microsoft 365 tenant. The app registration used by your Microsoft 365 connection needs two Microsoft Graph application permissions in addition to the ones required for mail:
Group.Read.AllGroupMember.Read.All
Add both permissions in the Microsoft Entra admin centre and grant admin consent. If you set up your Microsoft 365 connection before security groups were released, these permissions will not be on your app registration yet. See Connecting Microsoft 365 for the full permission list and setup steps.
Once the permissions are granted, open Connections and check that Groups shows as Connected for your Microsoft 365 connection. If it shows anything else, run Test connection and check the Groups row again. You cannot resolve groups in a policy until this row is connected.
You also need Admin or Super Admin access to your CloudM Continuity tenant.
Finding a group's Object ID
CloudM Continuity identifies groups by their Entra ID Object ID, which is a UUID such as 8e2a1c0b-.... There is no search or browse; you paste the ID in. The group's display name or email address will not work.
To find the Object ID:
- Sign in to the Microsoft Entra admin centre.
- Go to Groups, then All groups.
- Select the group.
- On the Overview page, copy the value shown as Object ID.
Adding groups to a policy
- Go to Policies in the sidebar and open the policy you want to change, or click Create policy.
- Under User selection, select the Groups tab. If the policy already has query rules, a dialog asks you to confirm the switch (see below).
- Paste the group's Object ID into the Entra ID group Object ID field and click Add.
- Repeat for each group you want to include. You can add up to 10 groups per policy. The counter shows how many you have added, and once you reach 10 the field is disabled with the tooltip "Maximum 10 groups can be added". Duplicate IDs and values that are not a valid Object ID are rejected.
- Click Check users. CloudM Continuity looks up each group through your Microsoft 365 connection and shows the group's display name with a member count. If a group cannot be found you will see the warning "Unable to resolve group name — verify the ID is correct." Check that you copied the full Object ID and that Groups shows as Connected on the Connections page.
- Finish the rest of the policy form and click Save (or Create policy for a new policy).
Users in any of the selected groups are included. A user only needs to be a member of one of the groups to be part of the policy. Nested groups are supported: if a selected group contains other groups, their members are included too. Groups are also looked up automatically whenever you reopen the policy, so you do not need to click Check users again just to see the names and counts.
Switching between Query builder and Groups
The two selection methods are mutually exclusive. When you switch tabs on a policy that already has rules or groups configured, a dialog explains what will happen. Switching to Groups shows:
Switch to Groups? Your existing query rules will be cleared when you save the policy. You can switch back to Query builder before saving to keep them.
Switching the other way shows the mirror message for your groups. Nothing is cleared until you save, so if you change your mind, switch back before saving and your original selection is kept.
How membership changes are picked up
CloudM Continuity re-reads group membership from Entra ID at the start of every sync cycle, and also refreshes it once a day. Users added to a group in Entra ID are picked up at the next sync and start syncing. Users removed from a group are dropped from the policy at the next sync. Changes are not picked up in real time, so allow up to one sync interval between changing a group in Entra ID and seeing the change reflected in CloudM Continuity.
The policy does not show when membership was last refreshed.
What you see once the policy is running
The policy form shows the groups you selected, each with its display name and member count, but does not list the individual members. The members appear on the Sync Status page like any other synced user, with their applied policy, and there is no indication there of whether a user came from a group or a query. The Dashboard's sync pipeline shows aggregate counts in the same way as for any policy.
Limitations
- Only Entra ID security groups are supported. Distribution lists, Microsoft 365 groups and Google groups cannot be used.
- A policy can hold up to 10 groups.
- Groups are added by Object ID only. There is no search, browse or picker.
- There is no option to add individual users by hand. Use a security group or a user query.
- Membership changes are picked up at the next sync cycle, not in real time.
Using groups with multiple policies
Security groups work with multiple policies in the same way as user queries. Different policies can target different groups, for example an hourly policy for one group and a daily policy for another. If a user is a member of groups in more than one active policy, the highest-priority active policy applies to them. Your licence counts unique users across all policies, so a user who appears in several groups or policies counts once. See Using multiple sync policies for how priority is resolved.
Next: Creating a sync policy