Adding Security groups in SharePoint and Office 365 groups

[Douglas Clelland]

Hello all!

We have several sites I have created for departments as Modern Team Sites connected to Groups (we are in SharePoint Online). I want to be able to utilize AD security groups for permssions to the Modern Team Sites connected to Groups. I can only add them from "Advanced Permissions" into the main 3 sharepoint groups (Owners, Members, Visitors)

But when folks from that AD group goes to said Modern Team Sites connected to Groups, it says they do not have permission to view. Do Modern Team Sites connected to Groups only accept adding indiviuals as users? when I do that everything works correctly

[#2]

Mmm...behind the scenes is still old SharePoint....but it's also true that Modern SPO Team sites are a little bit different compared to classic SPO sites. Adding here @Christophe Fiessinger

[#3]

Thank you @Juan Carlos González Martín I figured as much. We have a couple of sites built on the classic page model and AD security groups works as intended there. But not sites built from the Modern model

[#4]

Hi @Juan Carlos González Martín I also see this post from earlier this year, where it says adding AD security groups to Officce 365 groups does not work.

https://techcommunity.microsoft.com/t5/Office-365-Groups/How-to-manage-O365-Group-membership-through...

[#5]

Hi @Douglas Clelland

do you mean something like this:

Deploy an isolated SharePoint Online team site

[#6]

Correct, but the discussion is around adding nested Groups in the Group, not in the SPO Group site that can be managed independently

[#7]

So, to clarify: I create an O365 Group that, when created, has a SPO bound; after this, I want to use AD Security Groups to make user access the SPO pages of the O365?

[#8]

Hello @Marco Mangiante,

yes correct Create an Office 365 Group/SharePoint site, add AD Security Group like "Public Works Department" and they can then access all the sharepoint and O365 group features

[#9]

@Douglas Clelland

Have you tried to add the security group out of the "standard" groups (i.e. Owners, Members, and Visitors)?

In my experience, tweaking the "standard" groups by the "Advanced Permissions" UI doesn't work...

[#10]

Hello @Douglas Clelland

for SPO site I can confirm that I tried it and users can access and view pages when AD Security groups are nested inside SPO standard groups. If I remember, it is also possible to check if the permissions are working with the check button in the advanced UI.

Marco

[#11]

Had the same trouble - but found solution for Adding Local AD Security Groups to SharePoint Online Groups - Synced to Azure AD via Azure AD Connect to ur O365 tenant

Connect-PnPOnline –Url https://site.sharepoint.com/sites/YourSite –Credentials $cred
Add-PnPUserToGroup -LoginName Local_AD_Security-Group -Identity 'YourSite Members'

__________

Should remember that the Site Group associated with your Share Point site i.e. The Office 365 group - cannot currently have a Security Group of users from a Local AD Group added to it - HOWEVER there are Scripts available to Sync the users from an Local AD Group to an Office 365 Group.

You will want users in the Office 365 Group as well so that they can be affiliated with your Microsoft Teams Team and Channels (If you use Microsoft Teams that is)

_________

Hope this helps someone.

Cheers,

[#12]

@Adam Weldon-Ming This is pretty good but looks like I'd have to connect to each site one at a time.  My customer will have a couple hundred modern SPO M365 Team Sites with Groups.  One for each of their clients.  I can get the internal users setup with no problem to access the SP resources using 'Everyone Except External'.  Problem is, they can't get the Planner because they need to be site members.  OK so not a problem, just add the existing users as 'site members' into the provisioning site template that I'm building.  But what about new hires moving forward?  I need an easy to use method for my customer to add their new hires into hundreds of existing groups.  I can't add a security group, as others mentioned in this thread, which would resolve this issue by simply adding the new hire to the security group.  Any thoughts on my situation and how to best manage this?

[#13]

@Scott Smith  did you ever get an answer to this?  I'm also about to run into a scalability problem where adding new users is concerned.

[#14]

@trenish - The site members won't carry over into my provisioning template, presumably since that is basically managed as a Group resource.  I understand that this can be achieved in a 'tenant template' which I haven't yet mastered.  Or the preferred method of building an Azure Package which is a bit beyond my pay grade but also the client would require additional licensing. However, I've been able to craft two serviceable powershell methods.  One for my initial setup as I build sites and the other for future new hires to all existing sites:

1. Add a list of employees as 'Site Members' to a M365 Group

2. Add a new hire to a list of M365 Groups

Both processes worked for me.  They require exchange admin and a connect to exchange via powershell.  I believe you need a cmdlet installed first and local admin rights to the machine.

Connect-ExchangeOnline -UserPrincipalName you@email.com -ShowProgress $true

#Add multiple users to a single group.  Replace path and file name for your CSV and the O365 group name.  CSV header should be a single column with a header of 'Member' without quotes

Import-CSV "C:\path\members.csv" | ForEach-Object {
Add-UnifiedGroupLinks –Identity "O365GroupName" –LinkType Members  –Links $_.member
}

#Add single users to list of groups.  Replace path and file name of the TXT and the email

Foreach ($group in (get-content "c:\path\groups.txt")){
    Add-UnifiedGroupLinks $group –LinkType Member -Links "newhire@email.com"
}