HelpDesk role assigned a group to manage a dynamic group

[fporta044]

we are implementing a solution to manage an users group for each country assigned to its helpdesk group.

the idea is:

USA helpdesk group can manage USA users

FR helpdesk group can manage FR users

and so on

we created "USA helpdesk" group (with some member) and "USA users" group with dynamic group.

we need to match HelpDesk role, "USA helpdesk" group and "USA users" group

how can we do it?

[#2]

@fporta044 

Hi, Francesco.

The scenario you're describing is what a feature named "administrative units" targets:

• Administrative units in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn

Have a read and see for yourself.

With respect to what you've already done, you do not need the dynamic "USA users" group (at least not for this particular delegation scenario). Instead, you create a dynamic (though at this point in time it's still classed as being in preview) administrative unit which encompasses the USA users.

You then assign your "USA Helpdesk" group to this new administrative units with the relevant rights.

Note that there are licencing implications (aka costs) for using administrative units, as described in the article above.

As a side note, administrative units aren't that different under the hood to a dynamic group, and indeed work against the same tenant-wide upper limit for dynamic groups (i.e. [dynamic groups] + [administrative units] must be <= [service limit], which thankfully recently was increased from 5,000 to 15,000).

Cheers,

Lain

[#3]

@LainRobertson 

Hello,

thanks a lot

we imagined it. 

[#4]

@fporta044 

You may consider (user.country -eq "USA") on Dynamic group with RBAC