Multiple Group Selections

Question

Hi all! I am trying to figure out how dynamic groups and giving access can be in Microsoft Azure/Entra. For example, we have multiple business units with different systems, applications, erp's, etc. In azure, we want to create a new user, add them to groups first by selecting which business units they need access to, then that will go into selecting which systems, apps, etc. they can have access to within that business unit. From what I have researched, this seems possible, but I want to confirm it. Thanks!

Answer 1

Hi Ella,

If you are looking to utilzie nested Azure AD/Entra groups then take a look at this article:

https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/create-quot-nested-quot-groups-with-azure-ad-dynamic-groups/ba-p/3118024

I typically use Job Titles/Departments as an identifier for where people should be given access too. Have a look at the following page for what rules are available for dynamic groups:

Dynamic membership rules for groups in Azure Active Directory

https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership

Example:

(user.department -eq "Sales") -and (user.jobTitle -contains "SDE")

This example would include people in the Sales department with the Job Title SDE.

---

If this is helpful please accept answer.