Licensing Admin Roles using groups

%3CLINGO-SUB%20id%3D%22lingo-sub-94915%22%20slang%3D%22en-US%22%3ELicensing%20Admin%20Roles%20using%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-94915%22%20slang%3D%22en-US%22%3E%3CP%3EI%20know%20the%20ability%20to%20apply%20licenses%20to%20groups%20is%20in%20preview%2C%20but%20it%20there%20any%20functionatliy%20that%20would%20allow%20us%20to%20apply%20admin%20roles%20to%20groups%3F%20%26nbsp%3BFor%20example%2C%20we%20have%20an%20AD%20Group%20for%20everyone%20in%20a%20SPO%20Admin%20role.%20%26nbsp%3BI'd%20like%20to%20auto%20assign%20the%20SPO%20Admin%20role%20to%20that%20group%2C%20similar%20as%20you%20can%20assign%20licenses%20to%20groups.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-94915%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-95008%22%20slang%3D%22en-US%22%3ERe%3A%20Licensing%20Admin%20Roles%20using%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-95008%22%20slang%3D%22en-US%22%3E%3CP%3ENot%20that%20I've%20heard%20of.%20But%20it's%20easy%20enough%20to%20do%20via%20PowerShell%20-%20expand%20the%20group%20membership%20and%20pipe%20it%20against%20the%20Add-MsolRoleMember%20cmdlet.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2555064%22%20slang%3D%22en-US%22%3ERe%3A%20Licensing%20Admin%20Roles%20using%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2555064%22%20slang%3D%22en-US%22%3EI%20know%20it's%20an%20old%20thread%20and%20you%20might%20already%20know%20this%20but%20here%20goes%20%3A)%3C%2Fimg%3E%3CBR%20%2F%3ERole-assignable%20groups%20is%20in%20public%20preview.%20You%20need%20Azure%20AD%20Premium%20P1%20or%20P2%20for%20group%20members%20and%20to%20create%20one%2C%20you%20need%20to%20have%20the%20Privileged%20Role%20Admin%20or%20Global%20Admin%20role.%3CBR%20%2F%3EIf%20that%20is%20ok%2C%20you%20will%20see%20an%20extra%20slider%20option%20when%20creating%20a%20group%20'Azure%20AD%20roles%20can%20be%20assigned%20to%20the%20group'.%20Set%20this%20to%20Yes%20and%20at%20the%20bottom%20choose%20the%20roles%20you%20want%20to%20assign.%3CBR%20%2F%3ENote%20you%20cannot%20change%20this%20setting%20(on%2Foff)%20later%20and%20so%20you%20cannot%20add%20this%20capability%20to%20existing%20groups%20nor%20disable%20it%20afterwards.%3C%2FLINGO-BODY%3E
Regular Contributor

I know the ability to apply licenses to groups is in preview, but it there any functionatliy that would allow us to apply admin roles to groups?  For example, we have an AD Group for everyone in a SPO Admin role.  I'd like to auto assign the SPO Admin role to that group, similar as you can assign licenses to groups.

2 Replies

Not that I've heard of. But it's easy enough to do via PowerShell - expand the group membership and pipe it against the Add-MsolRoleMember cmdlet.

I know it's an old thread and you might already know this but here goes :)
Role-assignable groups is in public preview. You need Azure AD Premium P1 or P2 for group members and to create one, you need to have the Privileged Role Admin or Global Admin role.
If that is ok, you will see an extra slider option when creating a group 'Azure AD roles can be assigned to the group'. Set this to Yes and at the bottom choose the roles you want to assign.
Note you cannot change this setting (on/off) later and so you cannot add this capability to existing groups nor disable it afterwards.