Synchronizing AAD Security Groups with Office 365 Groups

PowerShell

Exploiting Security Groups

Dan Stephenson, one of the Teams program managers, posted an interesting script to synchronize the membership of an AAD security group with an Office 365 group. The idea is that you might have invested in security groups to control access to different resources and now want to extend that investment and use the same group membership for collaboration with Teams.

PowerShell is Flexible

One of the wonders of PowerShell is the way that you can come up with different answers to the same problem. Everyone has their own way to attack a problem and code a solution. Here’s the script we include in Chapter 14 of Office 365 for IT Pros, where we deal with the many joys of managing Office 365 Groups and Teams with PowerShell.

The script synchronizes the membership of a security group called eDiscovery Admins with an Office 365 Group called eDiscovery Administrators. The security group is the master, meaning that its membership is what we want to see synchronized to the Office 365 Group. Any members found in the Office 365 Group membership that are not in the security group are removed. You need to connect your PowerShell session to Azure AD and Exchange Online to access the cmdlets used in the script.

First, we fetch details of the two groups we want to synchronize.

Now we update the membership of the Office 365 Group based on the members of the security group.

The next step is to check the membership of the two groups and remove any member found in the Office 365 Group who doesn’t exist in the security group.

The next step for the budding PowerShell maestro to improve matters is to deal with nested groups (an exercise for the reader), improve error handling, and  come up with a way to run the script every day or so to ensure that the two group memberships remain synchronized.

We have a complete chapter (14) on using PowerShell in the Office 365 for IT Pros eBook. Not that you experts need to read it, but it is nice to know that the chapter is there.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.