Azure AD nested groups and role assignment in Enterprise Application

Question

I have an enterprise application in Azure with some roles defined, let's say:

• professor role
• student role
• staff role

Then I have some Active Directory groups which are nested, like:

• root professor group PROF
  • nested professor group PROF1
  • nested professor group PROF2
  • and many more similar, even more nested...
• root student group STUD
  • nested student group STUD1
  • nested student group STUD2
  • and many more similar, even more nested...
• root staff group STAFF
  • nested student group STAFF1
  • nested student group STAFF2
  • and many more similar, even more nested...

I can assign users and AD groups to those roles. However, when I want to assign a group to a role, it works only when a user is a direct member of the group. If, for instance, I add the whole group STUD to a role, it does not work with role assignment. Therefore I have to add all the single nested roles to the role, which is quite time consuming. But that would have been acceptable as one-time-solution. Bad thing is, there are new groups and users constantly. And I'd have to keep the role assignments up-to-date manually all the time.

Ideally I'd like to say: everyone from the STUD root AD group gets the student role etc. Apparently this is not possible: https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/15718164-add-support-for-nested-groups-in-azure-ad-app-acc

Is it maybe possible to do it via some automated script? Maybe you have some other ideas? Thanks in advance!

Answer 1

as you've discovered, azure ad currently does not treat nested groups nicely for a variety of situations, and as you have found in that thread that you posted microsoft is starting to work on a workaround. so the question is how much effort do you want to spend on trying to implement something that will likely be some kind of built in functionality in the medium term when microsoft releases a solution?

there are things you can do, like write a powershell script to flatten a group for example. but you would call that manually. to keep it clean, i would create a parent group for each appplication registration role. eg, create like a group called app_x_prof or something, put prof group in there. then flatten that. but that's still pretty manual.

if you really wanted to automate that, there are ways. eg, you could combine creating app role specific groups, add nested groups to that, then, run a power automate (flow) that you make periodically that goes through those specially named groups to grab all the users from nested groups and copy them to the root group..

all depends on how much effort and time.