How to manage O365 Group membership through AD Security Groups and/or nested O365 Groups?

[Morten Myrstad]

I have two issues concerning management of membership in Groups:

1. In the Outlook Widget, I see that I can add another O365 Group as a member in an O365 Group. But what does it mean? It seems like I am then adding the individual members from the other groups as members, not the Group as such? Or is the meaning of this that I should be able to manage individuals for instance in a "mother" group, and then add the group itself to another group as a nested group? Why don´t I then see the group in the membership list?

2. Security Groups and mail-enabled security groups seems to be a better way to manage a company or department team on a regular basis. But it does not seem that I am able to add an AD Security Group as a member in an Office 365 Group. Am I missing something, and/or is this on the roadmap?

[#2]

Hey all... we've just added a solution in our product that allows you to associate an O365 Group with one or more AD Security groups and have membership synced daily. PM me if you want more info on the apporach we used as I don't want to market all over this thread.

[#3]

@Eric_H,

Share you concern.

I am not sure what's your definition of Enterprise. We are a 60 people company and need the nested membership feature as desparately as you do. Hoping to see something sooner than later.

[#4]

Any news on this highly requested feature, @Christophe Fiessinger?

[#5]

we don't have any update to share at this stage. FYI @Mike McLean (OFFICE)

[#6]

I also want to add my vote for this feature we really need it.

[#7]

Just wanted to add our request for this.

Not being able to use our existing AD groups to maintain SPO membership for site is terrible.

60,000 users that have existing AD security groups for business units already, is not something I want to have to replicate or update in 2 locations.

Cheers

[#8]

I can't say enough how much this is required.  It kills me that I have to create the same business unit groups in both On-Prem and Office 365 groups, it just makes no sense.

I can only assume it is a plan to get people to upgrade to Azure AD Premium, whihc is terribly overpriced.  

Please get this figure out, it is preventing us from moving forward with using our SharePoint investment.

[#9]

Did you see that Group Writeback is in preview for Azure AD Connect?  I have not tested it yet, but based on comments it still needs improvement.

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-feature-...

[#10]

Link seems broken?

[#11]

I too would like to add to this. An absolute pain in adding members .

Absolutely nothing available for Hybrid set ups.  Having to replicate everything in two places is just ridiculous.

[#12]

I too would like to add to this. An absolute pain in adding members .

No simple powershell available for Hybrid set ups.  Having to replicate everything in two places is just ridiculous.

[#13]

Technically there's nothing that can't be done, but MS nudges you to the next tier constantly. 

• SharePoint (which is everything on the back end) will let you go so far as to add synced security groups without write-back.... but you need O365 Business Premium for that. 
• Teams will let you import a security group into a teams security group, but no sync there, so you're managing two groups (but at least you have the import). You also need O365 Business Premium, so why not just stick with SharePoint unless you're using the Skype integration (TBR). 
• Groups won't let you do squat other than add members. Have fun with that.
• Write-back? OMG... AAD P1 pricing is ridiculous.. at almost $8/user/month, you're looking at over $55k/yr on a 300 user compliment, just for full sync! Sick. So you're now being nudged to M365 E3 since you may as well be getting more out of it than just AD syncing. (All M365 offerings nudge to enterprise). 

I used to complain about trims on new cars, or cable TV packages... but MS just took the cake. 

[#14]

Had this very discussion today on a client site - large EDU customer. Now we do have AAD P1 licenses so can avail of Dynamic Groups in Azure. Seems sensible therefore to base membership off of the Department attribute - but, with this client they tell me that Department names often change so we'd end up with complex membership generation rules.

I can only assume the thinking here by Microsoft is that on-premise AD Security groups, manged by Admin, continue to secure local resources and that Office 365 Groups are managed, not by Admin but by the end users. So yes, we end up with two sets of groups essentially.

Not a great end result.

[#15]

Hi - Can you kindly elaborate.

Regards,

Chiranjib

[#16]

APIs are available to read AAD security group memberships, as well as write/modify O365 Group memberships--- you can build your own hooks between and keep select groups synced with a periodic sync. We've done something similar but productized it.

[#17]

Hi John, yould you elaborate more on this please? Do you have some links to resources I could use? Your Input is highly appreciated. 

[#18]

Hi Marc, this is referring to the way we implemented a spin on dynamic group membership in our Cloud Governance solution--- essentially you can base O365 group membership on AAD security groups and we will keep them synced... PM me if you want more info...

[#19]

So in short - you can not manage Office 365 Groups permissions based on groups/security groups/distribution groups ?

[#20]

I've been following this for a while now.  If anyone hasn't already, please go vote for this idea here: https://office365.uservoice.com/forums/286611-office-365-groups/suggestions/33942997-add-security-gr...

[#21]

You may find this amusing. We actually have a List on SharePoint that is a manually edited list which contains entries from the Office 365 Admin UI and the ECP so that people that are not Admins can see the groups and the members. Whenever we make a change to either one we have to update the others. Takes too much time when we hire new staff (or staff leave) that is in multiple DL, Shared Mailbox, or Security groups. Now we have to deal with O365 groups?