Entra ID provisioning api how to manage user group memberships?

Hi @Alistair Young • Thank you for reaching out.

It looks like you are trying to achieve automated group membership provisioning via bulk import?

I have tested this by using dynamic group membership using one of the properties used in the SCIM schema for the bulk imported user and this approach works fine, if the groups you are using actually can have dynamic membership.

Below you can see the bulk import via API:

And the status of the membership in the group via the department property of the imported users, no manual interaction was necessary in this case:

However, if you cannot utilize dynamic group memberships for any reason, for example you want to add the users to already existing of the membership type "Assigned" rather than dynamic you will have to follow a 2 step approach.

Group membership requires an object ID which only is available after the object has been created, post uploading the users with the bulkUpload api endpoint you could use the following group API Add group members. Please note that there is a transaction limit of 20 users with a single request when using this API call, so you may need to paginate the request.

The portal does offer a possibility to perform bulk group membership operations, but this is only available via the UI, currently neither the stable nor the beta Graph API documentation contain any steps or API endpoint for that operation, judging from the initial question this may not be exactly what you are looking for as it seems you want a fully automated workflow, but I will point to the Learn article so others may benefit of a small manual step mechanism. Read more: Bulk add group members in Microsoft Entra ID

Since you must have some sort of mapping mechanism from user properties to intended group membership if you wanted a full manual approach you could potentially scan the service logs of the User bulk import as described in the documentation (I'll point to the PowerShell example, but other examples exist as well) here: Get provisioning logs of the latest sync cycles, this would allow you to parse out the user IDs which you then can attribute map to the intended groups to create the csv files for either a manual bulk upload operation or for further processing via the aforementioned group-post-member API.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.