Attribute-based dynamic groups for O365

Question

I am trying to setup O365 group based licensing.  I tested with security group based licensing and it worked great.  But now, I like to create attribute-based dynamic groups, and I am not sure how to create attribute based dynamic groups with PowerShell.  Since we are not sure if we could afford Azure AD Premium, I like to create attributes based dynamic groups with PowerShell.  Is it possible to accomplish?

Also, I was wondering instead of using Azure AD, can I create dynamic security group on on-prem AD and sync to Azure AD?

Thank you.

Akiko

Answer 1

Hi Akiko,

Sure, it's possible to sync Security group from on-premises AD to Azure AD so the Group type shows Security. Also if you update members on premises, it also will sync to Azure AD. It's an expected behavior. But for Dynamic attribute-based Distribution Group in Azure AD, it will filter group members automatically based on the rule you created, which is different from Security group.

For your reference: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-understanding-users-and-contacts

Of course, based on your description, the Security group synced from on-premises AD can meet your request. We are glad to hear that and if you have any concern about it, you are welcomed to come back to us.

Thanks,

Iry

Answer 2

Hello Akiko,

I don't think it can possible to accomplish using Power Shell. You need to  

have Azure AD Premium license. 

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-dynamic-membership-azure-portal

No, group will not Sync with on-prem or vise-versa.

https://techcommunity.microsoft.com/t5/Azure-Active-Directory/Do-AzureAD-Dynamic-groups-sync-changes-to-On-Prem-security/td-p/45743

Thanks,

Answer 3

Iry,

Okay. It shows "Assigned" on membership type, but it also said, "synced"

 And it looks like member is updating every time I sync.

Akiko

Answer 4

Hi Akiko,

It requires Azure AD Premium P1 license to create attribute-based dynamic groups as Renie mentioned. Generally if you created AD security group on-premises AD, after you synced to Azure AD, the Membership type still shows Assigned and the Group type shows Security. They are grey out and cannot be modified.

Thanks,

Iry

Answer 5

Renie,

Thank you for your information.

I created AD security group based on attribute.  It is not dynamic security group, however, when I run the PowerShell, it can update the member based on attribute. Then after I sync AD to cloud, it looks like updating group member on Group based license.

I hope this works....  However, I am still afraid it might quit working when Group licensing Public Preview finishes.

Thank you.

Akiko