Is there a way to create a dynamic secgroup based on the membership of a distribution list?

Unique scenario I'm trying to figure out: we have SSO enabled on a 3rd party platform that leverages Entra/AzureAD for the idP. We just tested it and everything works great. So now I'm being asked to...