From 8ef10fc03a4f00e1fe1f5d979e1e5f5cea67d957 Mon Sep 17 00:00:00 2001
From: Rhys Ash <72310905+ASHR4@users.noreply.github.com>
Date: Mon, 22 Sep 2025 10:53:15 +0100
Subject: [PATCH 1/3] Update group limits and nesting scenarios in
documentation
---
docs/includes/entra-service-limits-include.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/includes/entra-service-limits-include.md b/docs/includes/entra-service-limits-include.md
index 4a56926d0b8..99fcc83a87e 100644
--- a/docs/includes/entra-service-limits-include.md
+++ b/docs/includes/entra-service-limits-include.md
@@ -19,7 +19,7 @@ Here are the usage constraints and other service limits for the Microsoft Entra
| Schema extensions |- String-type extensions can have a maximum of 256 characters.
- Binary-type extensions are limited to 256 bytes.
- Only 100 extension values, across *all* types and *all* applications, can be written to any single Microsoft Entra resource.
- Only User, Group, TenantDetail, Device, Application, and ServicePrincipal entities can be extended with string-type or binary-type single-valued attributes.
- Only the "equals" operator is supported for DateTime-type extensions. Range operators like "greater than" or "less than" are not supported.
|
| Applications | - A maximum of 100 users and service principals can be owners of a single application.
- A user, group, or service principal can have a maximum of 1,500 app role assignments. The limitation is on the assigned service principal, user, or group across all app roles and not on the number of assignments of a single app role. This limit includes app role assignments where the resource service principal has been soft-deleted.
- A user can have credentials configured for a maximum of 48 apps using password-based single sign-on. This limit only applies for credentials configured when the user is directly assigned the app, not when the user is a member of a group that is assigned.
- A group can have credentials configured for a maximum of 48 apps using password-based single sign-on.
- See additional limits in [Validation differences by supported account types](~/identity-platform/supported-accounts-validation.md).
|
|Application manifest |A maximum of 1,200 entries can be added to the application manifest.
See additional limits in [Validation differences by supported account types](~/identity-platform/supported-accounts-validation.md). |
-| Groups |- A non-admin user can create a maximum of 250 groups in a Microsoft Entra organization. Any Microsoft Entra admin who can manage groups in the organization can also create an unlimited number of groups (up to the Microsoft Entra object limit). If you assign a role to a user to remove the limit for that user, assign a less privileged, built-in role such as User Administrator or Groups Administrator.
- A Microsoft Entra organization can have a maximum of 15,000 dynamic groups (including those originating from Microsoft Entra entitlement management automatic assignment policies) and dynamic administrative units combined.
- A maximum of 500 [role-assignable groups](~/identity/role-based-access-control/groups-concept.md) can be created in a single Microsoft Entra organization (tenant).
- A maximum of 100 users can be owners of a single group.
- There is a limit of 1010 groups per token allowed for [Entra Kerberos](/troubleshoot/windows-server/windows-security/logging-on-user-account-fails).
- Any number of Microsoft Entra resources can be members of a single group.
- A user can be a member of any number of groups. When security groups are being used in combination with SharePoint Online, a user can be a part of 2,047 security groups in total. This includes both direct and indirect group memberships. When this limit is exceeded, authentication and search results become unpredictable.
- Starting with Microsoft Entra Connect v2.0, the V2 endpoint is the default API. The number of members in a group that you can synchronize from your on-premises Active Directory to Microsoft Entra ID by using Microsoft Entra Connect is limited to 250,000 members. For more information, see [Microsoft Entra Connect Sync V2](../identity/hybrid/connect/how-to-connect-sync-endpoint-api-v2.md).
- When you select a list of groups, you can assign a group expiration policy to a maximum of 500 Microsoft 365 groups. There's no limit when the policy is applied to all Microsoft 365 groups.
At this time, the following scenarios are supported with nested groups:- One group can be added as a member of another group, and you can achieve group nesting.
- Group membership claims. When an app is configured to receive group membership claims in the token, nested groups in which the signed-in user is a member are included.
- Conditional Access (when a Conditional Access policy has a group scope).
- Restricting access to self-serve password reset.
- Restricting which users can do Microsoft Entra join and device registration.
The following scenarios are *not* supported with nested groups:- App role assignment, for both access and provisioning. Assigning groups to an app is supported, but any groups nested within the directly assigned group won't have access.
- Group-based licensing (assigning a license automatically to all members of a group).
- Microsoft 365 Groups.
|
+| Groups |- A non-admin user can create a maximum of 250 groups in a Microsoft Entra organization. Any Microsoft Entra admin who can manage groups in the organization can also create an unlimited number of groups (up to the Microsoft Entra object limit). If you assign a role to a user to remove the limit for that user, assign a less privileged, built-in role such as User Administrator or Groups Administrator.
- A Microsoft Entra organization can have a maximum of 15,000 dynamic groups (including those originating from Microsoft Entra entitlement management automatic assignment policies) and dynamic administrative units combined.
- A maximum of 500 [role-assignable groups](~/identity/role-based-access-control/groups-concept.md) can be created in a single Microsoft Entra organization (tenant).
- A maximum of 100 users can be owners of a single group.
- There is a limit of 1010 groups per token allowed for [Entra Kerberos](/troubleshoot/windows-server/windows-security/logging-on-user-account-fails).
- Any number of Microsoft Entra resources can be members of a single group.
- A user can be a member of any number of groups. When security groups are being used in combination with SharePoint Online, a user can be a part of 2,047 security groups in total. This includes both direct and indirect group memberships. When this limit is exceeded, authentication and search results become unpredictable.
- Starting with Microsoft Entra Connect v2.0, the V2 endpoint is the default API. The number of members in a group that you can synchronize from your on-premises Active Directory to Microsoft Entra ID by using Microsoft Entra Connect is limited to 250,000 members. For more information, see [Microsoft Entra Connect Sync V2](../identity/hybrid/connect/how-to-connect-sync-endpoint-api-v2.md).
- When you select a list of groups, you can assign a group expiration policy to a maximum of 500 Microsoft 365 groups. There's no limit when the policy is applied to all Microsoft 365 groups.
At this time, the following scenarios are supported with nested groups:- Scurity Groups can be added as a member of another security group group, and you can achieve group nesting. Be aware of the [limitations](/entra/fundamentals/how-to-manage-groups#add-a-group-to-another-group)
- Group membership claims. When an app is configured to receive group membership claims in the token, nested groups in which the signed-in user is a member are included.
- Conditional Access (when a Conditional Access policy has a group scope).
- Restricting access to self-serve password reset.
- Restricting which users can do Microsoft Entra join and device registration.
The following scenarios are *not* supported with nested groups:- App role assignment, for both access and provisioning. Assigning groups to an app is supported, but any groups nested within the directly assigned group won't have access.
- Group-based licensing (assigning a license automatically to all members of a group).
- Microsoft 365 Groups.
|
| Application Proxy | - A maximum of 500 transactions\* per second per Application Proxy application.
- A maximum of 750 transactions per second for the Microsoft Entra organization.
\*A transaction is defined as a single HTTP request and response for a unique resource. When clients are throttled, they receive a 429 response (too many requests). Transaction metrics are collected on each connector and can be monitored using performance counters under the object name `Microsoft Entra private network connector`. |
| Access Panel |There's no limit to the number of applications per user that can be displayed in the Access Panel, regardless of the number of assigned licenses. |
| Reports | A maximum of 1,000 rows can be viewed or downloaded in any report. Any additional data is truncated. |
From 1fd53180e9ceb028e83fae64ff14b9d42bc4f250 Mon Sep 17 00:00:00 2001
From: Rhys Ash <72310905+ASHR4@users.noreply.github.com>
Date: Mon, 22 Sep 2025 10:56:16 +0100
Subject: [PATCH 2/3] Update service limits for Microsoft Entra groups
---
docs/includes/entra-service-limits-include.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/includes/entra-service-limits-include.md b/docs/includes/entra-service-limits-include.md
index 99fcc83a87e..9d191943d02 100644
--- a/docs/includes/entra-service-limits-include.md
+++ b/docs/includes/entra-service-limits-include.md
@@ -19,7 +19,7 @@ Here are the usage constraints and other service limits for the Microsoft Entra
| Schema extensions |- String-type extensions can have a maximum of 256 characters.
- Binary-type extensions are limited to 256 bytes.
- Only 100 extension values, across *all* types and *all* applications, can be written to any single Microsoft Entra resource.
- Only User, Group, TenantDetail, Device, Application, and ServicePrincipal entities can be extended with string-type or binary-type single-valued attributes.
- Only the "equals" operator is supported for DateTime-type extensions. Range operators like "greater than" or "less than" are not supported.
|
| Applications | - A maximum of 100 users and service principals can be owners of a single application.
- A user, group, or service principal can have a maximum of 1,500 app role assignments. The limitation is on the assigned service principal, user, or group across all app roles and not on the number of assignments of a single app role. This limit includes app role assignments where the resource service principal has been soft-deleted.
- A user can have credentials configured for a maximum of 48 apps using password-based single sign-on. This limit only applies for credentials configured when the user is directly assigned the app, not when the user is a member of a group that is assigned.
- A group can have credentials configured for a maximum of 48 apps using password-based single sign-on.
- See additional limits in [Validation differences by supported account types](~/identity-platform/supported-accounts-validation.md).
|
|Application manifest |A maximum of 1,200 entries can be added to the application manifest.
See additional limits in [Validation differences by supported account types](~/identity-platform/supported-accounts-validation.md). |
-| Groups |- A non-admin user can create a maximum of 250 groups in a Microsoft Entra organization. Any Microsoft Entra admin who can manage groups in the organization can also create an unlimited number of groups (up to the Microsoft Entra object limit). If you assign a role to a user to remove the limit for that user, assign a less privileged, built-in role such as User Administrator or Groups Administrator.
- A Microsoft Entra organization can have a maximum of 15,000 dynamic groups (including those originating from Microsoft Entra entitlement management automatic assignment policies) and dynamic administrative units combined.
- A maximum of 500 [role-assignable groups](~/identity/role-based-access-control/groups-concept.md) can be created in a single Microsoft Entra organization (tenant).
- A maximum of 100 users can be owners of a single group.
- There is a limit of 1010 groups per token allowed for [Entra Kerberos](/troubleshoot/windows-server/windows-security/logging-on-user-account-fails).
- Any number of Microsoft Entra resources can be members of a single group.
- A user can be a member of any number of groups. When security groups are being used in combination with SharePoint Online, a user can be a part of 2,047 security groups in total. This includes both direct and indirect group memberships. When this limit is exceeded, authentication and search results become unpredictable.
- Starting with Microsoft Entra Connect v2.0, the V2 endpoint is the default API. The number of members in a group that you can synchronize from your on-premises Active Directory to Microsoft Entra ID by using Microsoft Entra Connect is limited to 250,000 members. For more information, see [Microsoft Entra Connect Sync V2](../identity/hybrid/connect/how-to-connect-sync-endpoint-api-v2.md).
- When you select a list of groups, you can assign a group expiration policy to a maximum of 500 Microsoft 365 groups. There's no limit when the policy is applied to all Microsoft 365 groups.
At this time, the following scenarios are supported with nested groups:- Scurity Groups can be added as a member of another security group group, and you can achieve group nesting. Be aware of the [limitations](/entra/fundamentals/how-to-manage-groups#add-a-group-to-another-group)
- Group membership claims. When an app is configured to receive group membership claims in the token, nested groups in which the signed-in user is a member are included.
- Conditional Access (when a Conditional Access policy has a group scope).
- Restricting access to self-serve password reset.
- Restricting which users can do Microsoft Entra join and device registration.
The following scenarios are *not* supported with nested groups:- App role assignment, for both access and provisioning. Assigning groups to an app is supported, but any groups nested within the directly assigned group won't have access.
- Group-based licensing (assigning a license automatically to all members of a group).
- Microsoft 365 Groups.
|
+| Groups |- A non-admin user can create a maximum of 250 groups in a Microsoft Entra organization. Any Microsoft Entra admin who can manage groups in the organization can also create an unlimited number of groups (up to the Microsoft Entra object limit). If you assign a role to a user to remove the limit for that user, assign a less privileged, built-in role such as User Administrator or Groups Administrator.
- A Microsoft Entra organization can have a maximum of 15,000 dynamic groups (including those originating from Microsoft Entra entitlement management automatic assignment policies) and dynamic administrative units combined.
- A maximum of 500 [role-assignable groups](~/identity/role-based-access-control/groups-concept.md) can be created in a single Microsoft Entra organization (tenant).
- A maximum of 100 users can be owners of a single group.
- There is a limit of 1010 groups per token allowed for [Entra Kerberos](/troubleshoot/windows-server/windows-security/logging-on-user-account-fails).
- Any number of Microsoft Entra resources can be members of a single group.
- A user can be a member of any number of groups. When security groups are being used in combination with SharePoint Online, a user can be a part of 2,047 security groups in total. This includes both direct and indirect group memberships. When this limit is exceeded, authentication and search results become unpredictable.
- Starting with Microsoft Entra Connect v2.0, the V2 endpoint is the default API. The number of members in a group that you can synchronize from your on-premises Active Directory to Microsoft Entra ID by using Microsoft Entra Connect is limited to 250,000 members. For more information, see [Microsoft Entra Connect Sync V2](../identity/hybrid/connect/how-to-connect-sync-endpoint-api-v2.md).
- When you select a list of groups, you can assign a group expiration policy to a maximum of 500 Microsoft 365 groups. There's no limit when the policy is applied to all Microsoft 365 groups.
At this time, the following scenarios are supported with nested groups:- Scurity Groups can be added as a member of another security group group, and you can achieve group nesting. For more information, see [Manage Microsoft Entra groups and group membership](/entra/fundamentals/how-to-manage-groups#add-a-group-to-another-group)
- Group membership claims. When an app is configured to receive group membership claims in the token, nested groups in which the signed-in user is a member are included.
- Conditional Access (when a Conditional Access policy has a group scope).
- Restricting access to self-serve password reset.
- Restricting which users can do Microsoft Entra join and device registration.
The following scenarios are *not* supported with nested groups:- App role assignment, for both access and provisioning. Assigning groups to an app is supported, but any groups nested within the directly assigned group won't have access.
- Group-based licensing (assigning a license automatically to all members of a group).
- Microsoft 365 Groups.
|
| Application Proxy | - A maximum of 500 transactions\* per second per Application Proxy application.
- A maximum of 750 transactions per second for the Microsoft Entra organization.
\*A transaction is defined as a single HTTP request and response for a unique resource. When clients are throttled, they receive a 429 response (too many requests). Transaction metrics are collected on each connector and can be monitored using performance counters under the object name `Microsoft Entra private network connector`. |
| Access Panel |There's no limit to the number of applications per user that can be displayed in the Access Panel, regardless of the number of assigned licenses. |
| Reports | A maximum of 1,000 rows can be viewed or downloaded in any report. Any additional data is truncated. |
From 3bf4c53ced301d56e11b3d6e24ecff4c317658f2 Mon Sep 17 00:00:00 2001
From: Rhys Ash <72310905+ASHR4@users.noreply.github.com>
Date: Mon, 22 Sep 2025 10:57:45 +0100
Subject: [PATCH 3/3] Update entra-service-limits-include.md
---
docs/includes/entra-service-limits-include.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/includes/entra-service-limits-include.md b/docs/includes/entra-service-limits-include.md
index 9d191943d02..50e07985c4f 100644
--- a/docs/includes/entra-service-limits-include.md
+++ b/docs/includes/entra-service-limits-include.md
@@ -19,7 +19,7 @@ Here are the usage constraints and other service limits for the Microsoft Entra
| Schema extensions |- String-type extensions can have a maximum of 256 characters.
- Binary-type extensions are limited to 256 bytes.
- Only 100 extension values, across *all* types and *all* applications, can be written to any single Microsoft Entra resource.
- Only User, Group, TenantDetail, Device, Application, and ServicePrincipal entities can be extended with string-type or binary-type single-valued attributes.
- Only the "equals" operator is supported for DateTime-type extensions. Range operators like "greater than" or "less than" are not supported.
|
| Applications | - A maximum of 100 users and service principals can be owners of a single application.
- A user, group, or service principal can have a maximum of 1,500 app role assignments. The limitation is on the assigned service principal, user, or group across all app roles and not on the number of assignments of a single app role. This limit includes app role assignments where the resource service principal has been soft-deleted.
- A user can have credentials configured for a maximum of 48 apps using password-based single sign-on. This limit only applies for credentials configured when the user is directly assigned the app, not when the user is a member of a group that is assigned.
- A group can have credentials configured for a maximum of 48 apps using password-based single sign-on.
- See additional limits in [Validation differences by supported account types](~/identity-platform/supported-accounts-validation.md).
|
|Application manifest |A maximum of 1,200 entries can be added to the application manifest.
See additional limits in [Validation differences by supported account types](~/identity-platform/supported-accounts-validation.md). |
-| Groups |- A non-admin user can create a maximum of 250 groups in a Microsoft Entra organization. Any Microsoft Entra admin who can manage groups in the organization can also create an unlimited number of groups (up to the Microsoft Entra object limit). If you assign a role to a user to remove the limit for that user, assign a less privileged, built-in role such as User Administrator or Groups Administrator.
- A Microsoft Entra organization can have a maximum of 15,000 dynamic groups (including those originating from Microsoft Entra entitlement management automatic assignment policies) and dynamic administrative units combined.
- A maximum of 500 [role-assignable groups](~/identity/role-based-access-control/groups-concept.md) can be created in a single Microsoft Entra organization (tenant).
- A maximum of 100 users can be owners of a single group.
- There is a limit of 1010 groups per token allowed for [Entra Kerberos](/troubleshoot/windows-server/windows-security/logging-on-user-account-fails).
- Any number of Microsoft Entra resources can be members of a single group.
- A user can be a member of any number of groups. When security groups are being used in combination with SharePoint Online, a user can be a part of 2,047 security groups in total. This includes both direct and indirect group memberships. When this limit is exceeded, authentication and search results become unpredictable.
- Starting with Microsoft Entra Connect v2.0, the V2 endpoint is the default API. The number of members in a group that you can synchronize from your on-premises Active Directory to Microsoft Entra ID by using Microsoft Entra Connect is limited to 250,000 members. For more information, see [Microsoft Entra Connect Sync V2](../identity/hybrid/connect/how-to-connect-sync-endpoint-api-v2.md).
- When you select a list of groups, you can assign a group expiration policy to a maximum of 500 Microsoft 365 groups. There's no limit when the policy is applied to all Microsoft 365 groups.
At this time, the following scenarios are supported with nested groups:- Scurity Groups can be added as a member of another security group group, and you can achieve group nesting. For more information, see [Manage Microsoft Entra groups and group membership](/entra/fundamentals/how-to-manage-groups#add-a-group-to-another-group)
- Group membership claims. When an app is configured to receive group membership claims in the token, nested groups in which the signed-in user is a member are included.
- Conditional Access (when a Conditional Access policy has a group scope).
- Restricting access to self-serve password reset.
- Restricting which users can do Microsoft Entra join and device registration.
The following scenarios are *not* supported with nested groups:- App role assignment, for both access and provisioning. Assigning groups to an app is supported, but any groups nested within the directly assigned group won't have access.
- Group-based licensing (assigning a license automatically to all members of a group).
- Microsoft 365 Groups.
|
+| Groups |- A non-admin user can create a maximum of 250 groups in a Microsoft Entra organization. Any Microsoft Entra admin who can manage groups in the organization can also create an unlimited number of groups (up to the Microsoft Entra object limit). If you assign a role to a user to remove the limit for that user, assign a less privileged, built-in role such as User Administrator or Groups Administrator.
- A Microsoft Entra organization can have a maximum of 15,000 dynamic groups (including those originating from Microsoft Entra entitlement management automatic assignment policies) and dynamic administrative units combined.
- A maximum of 500 [role-assignable groups](~/identity/role-based-access-control/groups-concept.md) can be created in a single Microsoft Entra organization (tenant).
- A maximum of 100 users can be owners of a single group.
- There is a limit of 1010 groups per token allowed for [Entra Kerberos](/troubleshoot/windows-server/windows-security/logging-on-user-account-fails).
- Any number of Microsoft Entra resources can be members of a single group.
- A user can be a member of any number of groups. When security groups are being used in combination with SharePoint Online, a user can be a part of 2,047 security groups in total. This includes both direct and indirect group memberships. When this limit is exceeded, authentication and search results become unpredictable.
- Starting with Microsoft Entra Connect v2.0, the V2 endpoint is the default API. The number of members in a group that you can synchronize from your on-premises Active Directory to Microsoft Entra ID by using Microsoft Entra Connect is limited to 250,000 members. For more information, see [Microsoft Entra Connect Sync V2](../identity/hybrid/connect/how-to-connect-sync-endpoint-api-v2.md).
- When you select a list of groups, you can assign a group expiration policy to a maximum of 500 Microsoft 365 groups. There's no limit when the policy is applied to all Microsoft 365 groups.
At this time, the following scenarios are supported with nested groups:- For the security group type, you can add an existing group to another group, to achieve group nesting. For more information, see [Manage Microsoft Entra groups and group membership](/entra/fundamentals/how-to-manage-groups#add-a-group-to-another-group)
- Group membership claims. When an app is configured to receive group membership claims in the token, nested groups in which the signed-in user is a member are included.
- Conditional Access (when a Conditional Access policy has a group scope).
- Restricting access to self-serve password reset.
- Restricting which users can do Microsoft Entra join and device registration.
The following scenarios are *not* supported with nested groups:- App role assignment, for both access and provisioning. Assigning groups to an app is supported, but any groups nested within the directly assigned group won't have access.
- Group-based licensing (assigning a license automatically to all members of a group).
- Microsoft 365 Groups.
|
| Application Proxy | - A maximum of 500 transactions\* per second per Application Proxy application.
- A maximum of 750 transactions per second for the Microsoft Entra organization.
\*A transaction is defined as a single HTTP request and response for a unique resource. When clients are throttled, they receive a 429 response (too many requests). Transaction metrics are collected on each connector and can be monitored using performance counters under the object name `Microsoft Entra private network connector`. |
| Access Panel |There's no limit to the number of applications per user that can be displayed in the Access Panel, regardless of the number of assigned licenses. |
| Reports | A maximum of 1,000 rows can be viewed or downloaded in any report. Any additional data is truncated. |