Office 366 groups and AD groups

%3CLINGO-SUB%20id%3D%22lingo-sub-1973951%22%20slang%3D%22en-US%22%3EOffice%20366%20groups%20and%20AD%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1973951%22%20slang%3D%22en-US%22%3E%3CP%3EWe're%20setting%20our%20our%200365%20environment.%26nbsp%3B%20Right%20now%2C%20we%20have%20an%20on%20premise%20AD%20server%2C%20which%20we%20installed%20AD%20Connect%20and%20are%20successfully%20synching%20with%20AAD%20and%20Office365.%26nbsp%3B%20However%2C%20we're%20trying%20to%20manage%20our%20SharePoint%20sites%20and%20OneDrive%20permissions%20using%20local%20AD%20Groups.%26nbsp%3B%20I've%20created%20a%20local%20AD%20security%20group%20and%20added%20a%20few%20members.%26nbsp%3B%20It%20synchs%20to%20AAD%20successfully.%26nbsp%3B%20However%2C%20when%20i%20go%20to%20create%20a%20new%20site%20in%20sharepoint%2C%20I%20cannot%20see%20the%20group%2C%20only%20individual%20users.%26nbsp%3B%20I%20tried%20to%20then%20create%20an%20Office%20365%20group%20and%20add%20the%20local%20AD%20group%20to%20it%2C%20but%20that%20does't%20allow%20me%20to%20to%20add%20the%20local%20AD%20group%2C%20even%20though%20it%20shows%20up%20in%20AAD.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EIdeally%2C%20we%20want%20to%20be%20able%20to%20assign%20users%20permissions%20to%20SharePoint%20sites%20and%20OneDrive%20using%20local%20AD%20groups%2C%20how%20do%20we%20accomplish%20this%3F%20also%2C%20I%20read%20that%20if%20we%20do%20this%2C%20that%20we%20won't%20be%20able%20to%20share%20the%20sharepoint%20sites%20with%20external%20users%2C%20since%20the%20AD%20group%20will%20be%20managed%20at%20our%20local%20AD%20level.%26nbsp%3B%20This%20is%20why%20we%20wanted%20to%20add%20the%20local%20AD%20group%20to%20the%20Office365%20group%20so%20we%20can%20also%20allow%20external%20people%20access%20to%20the%20sites%20by%20adding%20them%20to%20the%20Office365%20group.%26nbsp%3B%20Basically%2C%20what%20is%20the%20correct%20way%20to%20do%20this%3F%20or%20best%20practice%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EThanks%20for%20your%20help.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1973951%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%20Groups%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESharePoint%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1974800%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20366%20groups%20and%20AD%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1974800%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20need%20mail-enabled%20security%20groups%20for%20that%20(the%20sharing%20part%20at%20least).%20Also%2C%20nesting%20groups%20inside%20an%20O365%20Group%20is%20not%20a%20supported%20scenario.%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

We're setting our our 0365 environment.  Right now, we have an on premise AD server, which we installed AD Connect and are successfully synching with AAD and Office365.  However, we're trying to manage our SharePoint sites and OneDrive permissions using local AD Groups.  I've created a local AD security group and added a few members.  It synchs to AAD successfully.  However, when i go to create a new site in sharepoint, I cannot see the group, only individual users.  I tried to then create an Office 365 group and add the local AD group to it, but that does't allow me to to add the local AD group, even though it shows up in AAD.  


Ideally, we want to be able to assign users permissions to SharePoint sites and OneDrive using local AD groups, how do we accomplish this? also, I read that if we do this, that we won't be able to share the sharepoint sites with external users, since the AD group will be managed at our local AD level.  This is why we wanted to add the local AD group to the Office365 group so we can also allow external people access to the sites by adding them to the Office365 group.  Basically, what is the correct way to do this? or best practice? 


Thanks for your help.

2 Replies

You need mail-enabled security groups for that (the sharing part at least). Also, nesting groups inside an O365 Group is not a supported scenario.

@Vasil Michev Thank you.  That's what I've been ready also, that it's not supported, but it was on their roadmap, but from what I was reading, it sounds like it was coming by the end of the year, I guess not.