Forum Discussion
Single group for TEAM AND Lighthouse (Security Group + 'Unified' group)
Trying to simplify our groups, since we are a 20+ year old firm, the variety of groups we have has bloated over the years. I'm trying to clean these up, but I've met a hitch.
Our Service Desk dept has their own Internal team. Aka a 365 Group. Aka a 'unified' group.
We use Lighthouse, which only takes Security Groups - it can't take the above 365 Group.
First instinct is to create a Security group that can be used for both. But I can't seem to find a way to do this. The 365 Group is unable to nest a Security group. The Security group is unable to nest a 365 Group. So there's no single source of truth.
I thought I could use Dynamic Grouping as a workaround - using the MemberOf property. But according to this, this Preview Feature is being abandoned and disabled.
Anyone have workarounds/advice? Here's the output I get, when trying to do this via EOM
PS C:\Users\lmtpo\Downloads> New-MgGroupMember -GroupID (team) -DirectoryObjectId (sec)
New-MgGroupMember : Non-Unified Security Groups cannot be added to Unified Groups. paramName: Members, paramValue...
PS C:\Users\lmtpo\Downloads> New-MgGroupMember -GroupID (sec) -DirectoryObjectId (team)
New-MgGroupMember : A Unified Group cannot be added as a member of a Distribution List or Security Group or Elevated
Group. paramName: Members, paramValue: , objectType: Microsoft.Online.DirectoryServices.Group
1 Reply
You have already found the limit: a Microsoft 365 group cannot be a member of a security group and the other way round, and a Team has to be backed by a Microsoft 365 group. So one object cannot be both. What works is to make the membership come from one place and keep the two groups in step with it. Two ways to do that:
- Dynamic membership on both groups with the same rule. Make the security group and the Microsoft 365 group both dynamic, with the same rule based on a user attribute (for example department equals Service Desk, or a job title or extension attribute). The attribute is then your single source of truth, and both the Team and Lighthouse see the same people. This needs Entra ID P1, and the attribute must be filled in reliably (from HR or on-premises sync).
- If you cannot rely on an attribute, keep one group as the master and sync it to the other. Make the security group the master, then either use a scheduled script or Power Automate flow using Microsoft Graph to copy the members of the Microsoft 365 group into the security group (or the reverse), or manage the people in the Microsoft 365 group and let the script write into the security group for Lighthouse. A small PowerShell script with Get-MgGroupMember and New-MgGroupMember run on a schedule (Azure Automation works well) is enough, and you only need to add and remove the differences.
- Whichever you pick, put the other group as read only in your process (nobody edits it by hand) and document which one is the master, otherwise they drift apart again.
I would use the first option if the department attribute is clean, and the second if membership is mostly managed by hand by the service desk lead.
