Forum Discussion
FuzzyWazHe
Feb 17, 2022Copper Contributor
Nested groups and Azure AD
Our business with a single forest is doing the two nested group method for everything. I have heard in discussions that in the Azure world this is no longer recommended practice and really only appl...
Chhorn_Lim
Microsoft
Feb 17, 2022
There is limited support for nested groups within Azure AD. Per the following doc (Service limits and restrictions - Azure Active Directory | Microsoft Docs), nested groups are only supported in certain scenarios. I've posted an excerpt from the doc below:
At this time, the following scenarios are supported with nested groups:
- One group can be added as a member of another group, and you can achieve group nesting.
- Group membership claims. When an app is configured to receive group membership claims in the token, nested groups in which the signed-in user is a member are included.
- Conditional access (when a conditional access policy has a group scope).
- Restricting access to self-serve password reset.
- Restricting which users can do Azure AD Join and device registration.
The following scenarios are not supported with nested groups:
- App role assignment, for both access and provisioning. Assigning groups to an app is supported, but any groups nested within the directly assigned group won't have access.
- Group-based licensing (assigning a license automatically to all members of a group).
- Microsoft 365 Groups.
brandonh-msft
Microsoft
Feb 03, 2023When will this
> any groups nested within the directly assigned group won't have access
be solved?
> any groups nested within the directly assigned group won't have access
be solved?