Okta Workflows fails to manage Microsoft Entra ID mail-enabled security groups or distribution groups because the Microsoft Graph API does not support these operations. Administrators can manage these groups using the Execute on-premises PowerShell with the Okta Workflows template.

Okta Workflows generates a 400 error when an administrator attempts to manage a Microsoft Entra ID mail-enabled security group or distribution group using the Azure Active Directory connector:

400 Bad Request

This error occurs with any action card that attempts to manage mail-enabled security or distribution groups, such as Update Group or Add User to Group.

{
	"retry_count": 0,
	"flo": "office365admin:1.0.202:updateGroup",
	"method": "ZDkPkSsYrFKwr",
	"execution": "154faa80-d805-4f24-ab0b-91f3e446041c",
	"module": "control.spawn",
	"kind": "HTTP Request Error",
	"statusCode": 400,
	"headers": {
		"client-request-id": "f561b2fb-87ba-42e8-a377-e8ca431a7c38",
		"x-ms-resource-unit": "1",
		"date": "Wed, 05 Nov 2025 23:45:34 GMT",
		"content-type": "application/json",
		"transfer-encoding": "chunked",
		"strict-transport-security": "max-age=31536000",
		"x-ms-ags-diagnostic": "{\"ServerInfo\":{\"DataCenter\":\"East US\",\"Slice\":\"E\",\"Ring\":\"5\",\"ScaleUnit\":\"007\",\"RoleInstance\":\"MN1PEPF0002F3DF\"}}",
		"request-id": "f561b2fb-87ba-42e8-a377-e8ca431a7c38",
		"cache-control": "no-cache"
	},
	"body": {
		"error": {
			"code": "Request_BadRequest",
			"message": "Cannot Update a mail-enabled security groups and or distribution list.",
			"innerError": {
				"date": "2025-11-05T23:45:34",
				"request-id": "f561b2fb-87ba-42e8-a377-e8ca431a7c38",
				"client-request-id": "f561b2fb-87ba-42e8-a377-e8ca431a7c38"
			}
		}
	},
	"message": "400 Bad Request",
	"description": "HTTP Request Error",
	"steps": 34,
	"source": {
		"flo": "office365admin:1.0.202:customAPIAction",
		"method": "pkazAoR_MaJQ0",
		"execution": "e05ca1f0-2a8f-4e7b-ab91-66279334bd1c",
		"module": "http.call"
	},
	"_fatal": null
}

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Workflows
• Azure Active Directory Connector

This is expected behavior. The Microsoft Graph API does not support managing Mail-enabled security groups or Distribution groups using the Microsoft Graph API.  The Azure Active Directory connector in Okta Workflows uses the Graph API, and therefore, it does not support managing these groups either. Microsoft recommends using O365 groups instead. Also note that since there is no Microsoft API that supports this, the Okta Workflows API connector cannot be used to manage Mail-enabled security groups or Distribution groups either.

For additional details, refer to the table in the Types of groups supported in Microsoft section of the Manage groups in Microsoft Graph documentation, which states that Mail-enabled security groups and Distribution groups cannot be managed via the Graph API and are read-only.