Skip to content
AscendCore
Back to Runbook Library
Identity Live in production

Group Membership Management

Automate Microsoft Entra security group, M365 group, and distribution list membership changes from Slack and Teams. Name-resolved, approval-gated, idempotent.

Integrates with

Entra ID

The problem

Group-membership requests are high-volume, low-risk, and chronically manual. A user joins a project team and needs to be added to the project's security group. Someone changes managers and the access groups need to be updated. An employee gets a promotion and the leadership distribution list needs the new name. Each request takes IT 5-10 minutes of clicking around in the Microsoft Entra admin center — and across hundreds of such requests per quarter, the cost adds up.

What AscendCore does

A user requests a group-membership change in Microsoft Teams or Slack with the explicit syntax group-add <email> <group name> or group-remove <email> <group name>. AscendCore resolves the user against Microsoft Entra ID, resolves the target group by exact display-name match (with disambiguation suggestions if multiple groups share the name), proposes the membership change to an IT admin, and executes via Microsoft Graph on approval.

Workflow

  1. Detect — chat command (group-add <email> <group name> or group-remove <email> <group name>)
  2. Resolve user — Microsoft Entra ID directory lookup by email or UPN
  3. Resolve group: exact display-name match in Microsoft Entra ID. If ambiguous, surface disambiguation candidates inline
  4. Propose — admin approval card with user, group, group type (security / M365 / distribution / mail-enabled), and group ID for verification
  5. Approve — one-click human approval (always required by default)
  6. Execute: the membership change is applied. Re-adding an existing member or removing a non-member is reported as success, so a repeated request is safe
  7. Notify — DM to the requester with the result
  8. Audit — every change logged with approver, target user, group ID, timestamp

Integrations

  • Microsoft Entra ID: group resolution and membership changes
  • Microsoft 365: Microsoft 365 groups and distribution lists
  • Slack + Microsoft Teams — request triggers and approval flow

Permissions

Requires a Microsoft Graph group-membership permission granted by admin consent in your Entra tenant. The exact permission is listed in the setup guide.

Status

Live in production. Real Microsoft Entra group membership changes execute end-to-end against real tenants with full audit trail and idempotency protection.

How it runs

Deterministic, approval-gated, auditable

Each runbook is a fixed, reviewed sequence of steps with an explicit approval policy. The AI only works out what was asked; the runbook decides what happens, a named person approves it, and every decision lands on the tamper-evident audit chain. Chat is just the interface that triggers it.

Ready to deploy

Run group membership management from Teams or Slack today

AscendCore deploys in days, not months for Slack + Okta or Teams + Entra stacks. See your first automated resolution the same day.

See plans & pricingBrowse all runbooks

More identity runbooks

Live

Access Role Change

Multi-system orchestrated role transitions for promotions, transfers, and contractor-to-FTE conversions. Five seed roles ship out of the box (support tiers, sales SDR/AE, engineering contractor/FTE/intern, HR generalist/manager); each transition produces a single approval card showing the full access diff and executes sequentially across Okta + Entra + Jira + M365 with per-step audit outcomes.

Read more
Live

Account Unlock

Automate Microsoft Entra ID and Okta account unlocks from Slack and Teams. Identity verification, approval-gated unlock, failed-login counter reset.

Read more
Live

Compromised Account Response

Contain a suspected account compromise in one approval: revoke every active session, invalidate the password, and force MFA re-enrollment, fully audited.

Read more