SOLVED

Create an Office 365 Dynamic Distribution List from members of an Azure AD Security Group

%3CLINGO-SUB%20id%3D%22lingo-sub-1250573%22%20slang%3D%22en-US%22%3ECreate%20an%20Office%20365%20Dynamic%20Distribution%20List%20from%20members%20of%20an%20Azure%20AD%20Security%20Group%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1250573%22%20slang%3D%22en-US%22%3E%3CP%3EGreetings.%26nbsp%3B%20We%20are%20trying%20to%20create%20a%20DDL%20from%20an%20on%20premise%20AD%20security%20group%20that%20is%20replicating%20to%20our%20Azure%20AD.%26nbsp%3B%20I%20have%20checked%20the%20Azure%20group%2C%20and%20it%20has%20all%203050%20users%20in%20it%20that%20the%20OnPrem%20group%20has.%26nbsp%3B%20It%20is%20%3CEM%3E%3CSTRONG%3Enot%3C%2FSTRONG%3E%3C%2FEM%3E%20mail%20enabled.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20syntax%20we%20are%20trying%20to%20use%20is%3A%3C%2FP%3E%3CP%3E%22((RecipientType%20-eq%20'UserMailbox')%20-and%20(MemberOfGroup%20-eq%20'CN%3D%5BOnPremAD_Groupname%5D%2COU%3D%5BOU%20for%20groups%20in%20location%5D%2COU%3D%5BOU%20for%20location%5D%2CDC%3D%5BAD%20Domain%5D%2CDC%3Dcom'))%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EExample%3A%3C%2FP%3E%3CP%3E%22((RecipientType%20-eq%20'UserMailbox')%20-and%20(MemberOfGroup%20-eq%20'CN%3DActualGroupName%2COU%3DGroups%2COU%3DMemphis%2CDC%3DContoso%2CDC%3Dcom'))%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20I%20successfully%20created%20a%20DDL%20before%20from%20members%20of%20an%20Office%20365%20Group%2C%20I%20needed%20to%20include%20the%20Object%20ID.%26nbsp%3B%20For%20that%20I%20used%20the%20syntax%3A%3C%2FP%3E%3CP%3E%22((RecipientType%20-eq%20'UserMailbox')%20-and%20(MemberOfGroup%20-eq%20'CN%3D%5Bgroupaliasname%5D_%5Bgroup%20Object%20ID%5D%2COU%3D%5Bcompany%5D.onmicrosoft.com%2COU%3DMicrosoft%20Exchange%20Hosted%20Organizations%2CDC%3DNAMPR01A004%2CDC%3Dprod%2CDC%3Doutlook%2CDC%3Dcom'))%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EQuestion%20%231%3C%2FSTRONG%3E%2C%20does%20the%20CN%20change%20for%20the%20AD%20group%20as%20it%20exists%20in%20the%20Azure%20AD%3F%20(I%20assume%20so)%3C%2FP%3E%3CP%3E%3CSTRONG%3EQuestion%20%232%3C%2FSTRONG%3E%2C%20how%20do%20I%20list%20and%20see%20the%20CN%20of%20a%20group%20in%20the%20Azure%20AD%3F%26nbsp%3B%20It%20is%20not%20listed%20in%20the%20attributes%20when%20I%20do%20a%20%22Get-AzureADGroup%20-ObjectID%20(group)%20%7C%20fl%22%3C%2FP%3E%3CP%3E%3CSTRONG%3EQuestion%20%233%3C%2FSTRONG%3E%2C%20do%20I%20need%20to%20attache%20the%20Object%20ID%20of%20the%20group%20to%20the%20group%20name%20once%20I%20have%20the%20correct%20CN%20for%20the%20Azure%20AD%20group%3F%20(I%20assume%20so)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20any%20help%20you%20can%20provide.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1250573%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1251377%22%20slang%3D%22en-US%22%3ERe%3A%20Create%20an%20Office%20365%20Dynamic%20Distribution%20List%20from%20members%20of%20an%20Azure%20AD%20Security%20Group%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1251377%22%20slang%3D%22en-US%22%3E%3CP%3EWhat%20you%20need%20to%20provide%20for%20the%26nbsp%3B%3CSPAN%20style%3D%22display%3A%20inline%20!important%3B%20float%3A%20none%3B%20background-color%3A%20%23ffffff%3B%20color%3A%20%23333333%3B%20font-family%3A%20'SegoeUI'%2C'Lato'%2C'Helvetica%20Neue'%2CHelvetica%2CArial%2Csans-serif%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%3EMemberOfGroup%20%3C%2FSPAN%3Efilter%20is%20the%20DistinguishedName%20of%20the%20group%2C%20which%20you%20can%20get%20from%20Get-Group%2FGet-DistributionGroup%2Fetc.%20And%20yes%2C%20it%20does%20differ%20between%20on-premises%20and%20the%20cloud.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20your%20group%20is%20not%20mail-enabled%20though%2C%20chances%20are%20you%20will%20not%20be%20able%20to%20%22see%22%20it%20with%20any%20of%20the%20Exchange%20cmdlets%2C%20so%20that%20method%20will%20not%20work.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1252131%22%20slang%3D%22en-US%22%3ERe%3A%20Create%20an%20Office%20365%20Dynamic%20Distribution%20List%20from%20members%20of%20an%20Azure%20AD%20Security%20Group%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1252131%22%20slang%3D%22en-US%22%3E%3CP%3EGet-Group%20worked.%26nbsp%3B%20That%20was%20the%20tip%20I%20needed!%20Thanks.%26nbsp%3B%3C%2FP%3E%3CP%3EI'll%20try%20again%20with%20the%20AzureAD%20DistinguishedName%2C%20and%20if%20it%20still%20fails%2C%20I%20can%20make%20it%20mail-enabled.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20again.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Greetings.  We are trying to create a DDL from an on premise AD security group that is replicating to our Azure AD.  I have checked the Azure group, and it has all 3050 users in it that the OnPrem group has.  It is not mail enabled.

 

The syntax we are trying to use is:

"((RecipientType -eq 'UserMailbox') -and (MemberOfGroup -eq 'CN=[OnPremAD_Groupname],OU=[OU for groups in location],OU=[OU for location],DC=[AD Domain],DC=com'))"

 

Example:

"((RecipientType -eq 'UserMailbox') -and (MemberOfGroup -eq 'CN=ActualGroupName,OU=Groups,OU=Memphis,DC=Contoso,DC=com'))"

 

When I successfully created a DDL before from members of an Office 365 Group, I needed to include the Object ID.  For that I used the syntax:

"((RecipientType -eq 'UserMailbox') -and (MemberOfGroup -eq 'CN=[groupaliasname]_[group Object ID],OU=[company].onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=NAMPR01A004,DC=prod,DC=outlook,DC=com'))"

 

Question #1, does the CN change for the AD group as it exists in the Azure AD? (I assume so)

Question #2, how do I list and see the CN of a group in the Azure AD?  It is not listed in the attributes when I do a "Get-AzureADGroup -ObjectID (group) | fl"

Question #3, do I need to attache the Object ID of the group to the group name once I have the correct CN for the Azure AD group? (I assume so)

 

Thanks for any help you can provide.

 

 

 

2 Replies
Highlighted
Best Response confirmed by DougTraylor (Occasional Contributor)
Solution

What you need to provide for the MemberOfGroup filter is the DistinguishedName of the group, which you can get from Get-Group/Get-DistributionGroup/etc. And yes, it does differ between on-premises and the cloud.

 

If your group is not mail-enabled though, chances are you will not be able to "see" it with any of the Exchange cmdlets, so that method will not work. 

Highlighted

Get-Group worked.  That was the tip I needed! Thanks. 

I'll try again with the AzureAD DistinguishedName, and if it still fails, I can make it mail-enabled.

 

Thanks again.