When you try to assign a Teams policy package to a security group in the Teams admin center, you may see an error that says the assignment failed. This happens because policy package assignments for groups only work with Microsoft 365 groups, not with security groups. In this article, you will learn why this restriction exists and how to apply the same policy settings to users in a security group using an alternative method.
You will also find step-by-step instructions for editing group policy assignments, creating a batch policy assignment, and verifying that the policies took effect. The root cause is a design limitation in Teams that requires group-based policy assignments to use Microsoft 365 groups. By the end, you will be able to work around this limitation without losing any policy coverage.
Key Takeaways: Assigning Teams Policy Packages to Security Groups
- Teams admin center > Policy packages > Group policy assignment: Only Microsoft 365 groups are supported, so security groups cause an error.
- Teams admin center > Users > Manage users > Policies: Shows the effective policy assignments that can be edited for individual users.
- New Teams admin center > User batch policy assignment: Lets you apply a policy package to many users at once, bypassing the group restriction.
Why Teams Rejects Policy Package Assignments for Security Groups
Teams policy packages are bundles of preset policies that apply to a group of users. For example, the Education_Teacher package includes meeting, messaging, and calling policies that are appropriate for teachers. When you assign a package to a group, Teams applies the package to all members of that group.
The Teams admin center only supports group policy assignments for Microsoft 365 groups. Security groups do not have the same underlying directory structure that Teams uses for policy propagation. Microsoft designed this feature to work with Microsoft 365 groups because they have a mailbox and a team site, which are required for the policy engine to track assignments reliably.
If you try to assign a package to a security group, the admin center displays an error message that says the assignment failed. The error text usually mentions that the group type is not supported. This is not a bug in your tenant; it is a deliberate limitation that you must work around.
What Happens When You Attempt the Assignment
When you select a security group and click Assign, Teams validates the group type. Because the group is not a Microsoft 365 group, the validation fails. The admin center then shows a red banner at the top of the page with the error message. No policy changes are made to any user in the security group.
Steps to Apply a Policy Package to Users in a Security Group
You have two reliable ways to apply a policy package to users who are members of a security group. The first method uses a batch policy assignment, which is the closest alternative to a group assignment. The second method edits the policy assignments for individual users. Both methods achieve the same result.
Method 1: Use a Batch Policy Assignment
- Open the Teams admin center
Go to admin.teams.microsoft.com and sign in with an account that has the Teams Administrator or Global Administrator role. - Navigate to the policy packages page
In the left navigation, select Policy packages. A list of available packages appears. - Select the desired package
Click the name of the package you want to assign, such as Education_Teacher or Education_Student. - Open the batch assignment option
On the package details page, click Batch assign in the command bar. This opens a panel where you can select users. - Choose the users from the security group
In the panel, click Add users. Use the search box to find users by name or email. Alternatively, you can export a list of users from the security group in the Microsoft 365 admin center and then import that CSV file here. - Assign the package
After you have added all users, click Apply. Teams processes the assignment and shows a success message when it finishes.
Method 2: Edit Policy Assignments for Individual Users
- Go to Users
In the Teams admin center, select Users in the left navigation. - Find the first user
Use the search box to locate a user who is a member of the security group. Click the user’s display name to open the user details page. - Open the Policies tab
On the user details page, click the Policies tab. This shows all current policy assignments for that user. - Select the policy package
Next to Policy package, click Edit. In the dropdown, select the package you want to apply. - Save the assignment
Click Apply to save. Repeat these steps for every user in the security group. This method is practical when the group has only a few members.
If Teams Still Shows an Error After the Workaround
The workarounds above solve the group type limitation. However, you may encounter other errors that prevent the package from being assigned. Here are the most common ones and how to fix them.
Batch Assignment Fails Because the User Already Has a Policy Package
If a user already has a policy package assigned, the batch assignment may fail for that user. Teams does not allow two packages on the same user. Remove the existing package first by going to the user’s Policies tab and setting the package to None. Then run the batch assignment again.
Policy Package Does Not Appear in the User’s Policy List
After you assign a package, it may take up to 24 hours for the policies to propagate. Check the user’s Policies tab after a few hours. If the package still does not appear, sign out and sign back in to the Teams admin center, then check again. You can also use the Get-CsUserPolicyAssignment PowerShell cmdlet to verify the assignment.
You Cannot See the Policy Package in the Admin Center
Some policy packages are only visible if your tenant has the correct license. For example, the Education packages appear only for tenants with education licenses. If you do not see a package, check your license in the Microsoft 365 admin center. If you lack the license, create a custom policy package by selecting Custom when you create a new package.
Group Policy Assignment vs Batch Assignment: Key Differences
| Item | Group Policy Assignment | Batch Policy Assignment |
|---|---|---|
| Supported group types | Microsoft 365 groups only | Any user list, including security group members |
| Setup effort | Low, but fails for security groups | Moderate, requires manual user selection |
| Automatic updates for new members | Yes, new group members get the package automatically | No, you must run the batch again for new users |
| Best for | Large, stable Microsoft 365 groups | Security groups or one-off assignments |
The table shows that group assignments are more convenient for Microsoft 365 groups. For security groups, batch assignments are the only practical route. If you need automatic updates for new members, consider converting your security group to a Microsoft 365 group in the Microsoft 365 admin center.
You can now apply a Teams policy package to users in a security group by using the batch assignment feature or by editing individual user policies. Both methods avoid the unsupported group type error. For a more permanent solution, convert the security group to a Microsoft 365 group so that future assignments work directly. To verify your work, open the Teams admin center and check the policy assignments for a few users under Users. Use the Get-CsUserPolicyAssignment PowerShell cmdlet to confirm that the package policies are active.