ThomasNielsen SSPR supports group nesting. We've been nesting dynamic groups within a single static for a while now (5+ years)
Peter_Holdridge Conditional Access supports nested groups as well. There was a time when the whatif tool didn't like it. I've not used that since Report-Only became mainstream.
https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/directory-service-limits-restrictions
At this time, the following scenarios are supported with nested groups:
- One group can be added as a member of another group, and you can achieve group nesting.
- Group membership claims. When an app is configured to receive group membership claims in the token, nested groups in which the signed-in user is a member are included.
- Conditional access (when a conditional access policy has a group scope).
- Restricting access to self-serve password reset.
- Restricting which users can do Azure AD Join and device registration.
The following scenarios are not supported with nested groups:
- App role assignment, for both access and provisioning. Assigning groups to an app is supported, but any groups nested within the directly assigned group won't have access.
- Group-based licensing (assigning a license automatically to all members of a group).
- Microsoft 365 Groups.
Microsoft