Forum Discussion
Nested AD Group synced to AAD, used for SharePoint Permissions
I'm using a similar structure:
[user] - [deparment-group] - [resource-group] - [SharePoint resource]
and have similar issues. Sometimes users can access the [SharePoint resource] and a couple of hours later the same user gets an access denied.
Have you found the source of your problem?
We've seen time and again that you can't use groups in groups in Sharepoint Online... at least not reliably. So we are using synced AD Groups (that have no nested groups) and granting them the rights directly. This is definately not how we would have liked to do it, but it seems to be the only thing that works.
In some instances we have used PowerShell to automatically sync users between OnPrem AD Groups and Sharepoint Groups. In this scenario you can actually have nested groups in the AD group and just use PowerShell to resolve all the members. It's a bit extensive to do, but in a few instances with too many changes on a regular basis it seems worth the extra effort.