Site Collection Owners based on AD Group membership

Hello,

We are looking for a way to automatically add a secondary collection administrators based on the membership of an AD group

Ex: UserA currently has a personal site "my.sharepoint.com/personal/UserA" up and running, if the userA is a member of ADGroup xx we automatically add a secondary owner to his personal site.

If UserA has no membership to ADGroup XX we don't change permissions.

Has anyone came across this requirement? Any suggestion of how could this be achieved with Powershell is greatly appreciated.