Create "nested" groups with Azure AD Dynamic Groups

How long will this be in Preview?

IMHO:

1. nested dynamic groups will not happen due to load on MS infrastructure

2. MS is using Rule Based Membership internally (see https://youtu.be/edOm79NL6U8?si=4as7MgQBNv1SSBOH&t=1744 )

3. Group Membership Management (GMM) can be found at https://github.com/microsoftgraph/group-membership-management-tenant 

Yawn. Really? This is news? I just had to create another set of 'flattened' DDG for some app roles from on premise groups. I had to recurse 4 levels deep to get all the nested groups. I do have repeatable code but every time some user who is managing one of these nested groups adds another nested group, we will have to rerun my query builder PowerShell script and update the dynamic query in Entra. Frankly I think a scheduled job that just recurses the on-premises groups and dumps the users into a security group is likely cleaner.

Hey MS, how about this for a great idea. Support nested groups! Then maybe we can all thank you for reals.

-ck

KristinaHotz ,
What about the support for Hybrid groups synced from OnPremise AD DS, will there by any supports soon ?

Hello, KristinaHotz. 

As you know, there are some significant limitations noted in documentation, while this feature is in preview (Group membership for Microsoft Entra dynamic groups with memberOf - Microsoft Entra ID | Microsoft Learn). 

With the move to App Centric Management in Microsoft Teams, we're being told by Microsoft Teams Engineering group to use groups if we want to block apps for a subset of our user base. This will require dynamic groups. We're very nervous to rely on a preview feature for something of this importance.

Is there any update as to when dynamic groups will be GA?

The following scenarios are not supported with nested groups:

• App role assignment, for both access and provisioning. Assigning groups to an app is supported, but any groups nested within the directly assigned group won't have access.
• Group-based licensing (assigning a license automatically to all members of a group).
• Microsoft 365 Groups.

   

Literally every scenario that I actually need this functionality.

Like others, I'm getting the same error and none of my verifications work.  Does anyone have this working?

This feature has been out since June 2022 and it's STILL in preview.

This feature is pretty useless as it currently stands. You can use it for only one use case - "is member of this group." that's it. You can't say "is member of this group, but not this group" or "member of this group and employeetype=Employee".

Completely useless for most use cases guys. This has so much potential but it's so extremely limited to solve only one small problem. Fortunately, I'm great at PowerShell.

Getting the same error. Here is the Rule syntax: 

user.memberof -any (group.objectId -in ['931c7908-f973-46cb-98a8-11ba998c75a4'])

It appears this has been broken some time in the last couple of weeks.

I was able to create a new dynamic membership group based off other group memberships a week or two ago, but now I can no longer modify these as they failed the validation check when saving.