Office 365 Exchange Online: Cannot change security group to distribution group, and vice versa.
Following on from my previous post on distribution groups and setting the SendAs permission, I discovered that Office 365 online has had a bit of a makeover and when making a distribution group, there is now an option to make that distribution group a security group. So, what is a security group and why does this matter? The short answer is it doesn’t, because a security group can do everything a distribution ground can. The slightly longer answer is that both security and distribution groups are active directory constructs, that security groups can do everything distribution groups can, and that distribution groups are specifically orientated towards email (for example, they lack assignable file and folder permissions that security groups feature.
Being the active directory and exchange simpleton that I am, I don’t really understand the purpose of Microsoft offering such an option for their Exchange Online service other then to further homogenize their self-hosted server and cloud based exchange offerings. Despite security groups offering all the functionality of distribution groups, I think it’s important to use the right tool for the right job. As in, there’s surely a good reason why distribution groups have a limited subset of features and are specifically orientated towards exchange. If all you want to to is create virtual addresses (ie: distribution group addresses) and have those emails directed towards multiple recipients within your organisation, then it’s distribution groups, not security groups, that you want to be creating.
So, what if you’ve accidentally created some security groups when what you were really after, were distribution groups? Well I did just that and assumed wrongly that there’d be an easy way to change between security and distribtion group types. Unfortunately not. If you’ve created a security group in exchange online and would like to change it to a distribution group via the online interface, or even the PowerShell, then you’re out of luck. The same goes for the reverse process.
The closest I got is finding out about this Set-AdGroup command that I couldn’t get to work in PowerShell. Also, in PowerShell running the GetDistributionGroup command will list all your groups and their ‘grouptype’. For distribution groups you’ll see the grouptype is specified as ‘universal’. For security groups the grouptype is ‘universal, security enabled’. And this, I believe is the property that needs changing if we want to change a security group to a distribution group, and vice versa. Microsoft, why offer an option on your online GUI interface if after applying there is no way to revert that change other than to delete the group and start over? Have a missed something here? If you read this and have a solution other than group deletion, recreation, or turning a blind eye, please let me know.
Office 365 Exchange Online: Cannot change security group to distribution group, and vice versa. was originally published on Pork Belly