Google Cloud / G Suite Connector by Microsoft Groups Provisioning

Question

Hi all,

We're making use of the Google Cloud / G Suite Connector by Microsoft to provision users from Microsoft Azure Active Directory to Google Workspace.

We followed this handy guide - https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on - and overall the set up went really well.

We are able to successfully provision users and groups - and it works really well.

To further enhance this, the next modification we wanted to achieve was --> If a user is part of the group 'Google Provision', then provision them in Google Workspace. If they are not a member, don't provision the user.

To achieve this, under the provisioning settings we switched it from 'sync all users and groups' to 'sync only assigned users and groups'.

Once done, headed to the users and groups section of that application where we added the provision group:

Upon testing, we added a user and put them into that group - they provisioned. We also created another user who isn't in that group - they didn't provision. Works really well.

The main issue that we're facing is that now that it's set to only provision assigned users and groups, this means that groups aren't provisioned in Google Workspace.

While it makes sense why this is happening, we're not sure how to have all groups provisioning as normal.

I attempted to create a scoping filter in the hope that this would override things / take priority. Under groups, I created a displayName is not null (e.g. not empty):

Is there a way to have all groups provision as normal while having user provisioning restricted to users in specific groups?

Initially, I was thinking of using a scoping filter to achieve the "user is member of the group", but turns out that isMemberOf is not currently supported yet - according to this link.

Let me know if there are any workarounds. Thanks for your help.

Answer 1

Scoping filters apply after the filtering from assignments with Sync Assigned Users/Groups.

I think you can achieve your end goal by creating a group (ideally dynamic..) and having all groups that you wish to provision be a first-level member of that group, and then assign the parent (hopefully dynamic) group to the application. The groups that are directly a member of the assigned group will be considered assigned/entitled for provisioning, but their members will not be entitled to provisioning. Only users that are direct members (rather than nested members) of an assigned group would be provisioned.

Answer 2

In addition to what ZollnerD mentioned, I'd like to give more information on Dynamic groups in Azure Active Directory. I hope this was helpful.

Create or update a dynamic group in Azure Active Directory: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-create-rule
Dynamic membership rules for groups in Azure Active Directory: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership