Office 365 security groups - sync

[Katy]

Has anybody managed to sync security groups to 365?

 

Basically I want to add the staff group to permissions for some sharepoint sites. I don't want to make a cloud Staff group and then manually keep it up to date when we're already doing this with an AD security group.

Alternatively some way to make a group based on the user's Department would work, if it kept itself up to date, but we don't want to buy Azure AD Premium just to get this single feature.

 

What's everyone else to for staff sites in sharepoint?

[ADMaster]

Yes I have security groups syncing.

The only group I could not get to sync was one that was named the same as an online created O365 group. I've not really worked at fixing that though.

 

I think your security group needs to have an email address to sync.

[Katy]

I found something saying they had to be Universal groups with a displayName and email address... I've done that and no sync. Although maybe I need to give it a proxyAddresses entry?

[Katy]

...I did something really stupid. when I set up AADConnect about 4 years ago I picked a few specific OUs to sync from, basically Users and DistributionGroups. So of course a security group sat in the SecurityGroups OU won't sync. Moved it and it synced straight away, oops.

[HPlum78]

You can Re run the setup and select/ reselect the OUs you want to include in the sync. So your not stuck / haunted by your past choices.

 

Well at least where this is concerned.....

[snagrat]

You don’t even need to rerun the setup, just edit the OUs in the Synchronisation Service program

[HPlum78]

Yep sure can, if you know your way round the sync service.

[HPlum78]

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering

 

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-custom#connect-your-directories

[Katy]

Thanks, will give it a go, although I seem to recall it's on the same page it asks for your enterprise admin account (I don't have one, only domain admin) so hope it lets me save changes without one.

[HPlum78]

You will need to have some Admin rights in your subscription from memory.