outside the box thinking - Azure dynamic device group with OU

[KK20]

I know that azure devices and OUs are tricky but I am trying to get some out of the box thinking so that I can create dynamic device groups that have logic based on their OUs. I already have a dynamic user group based on OUs as you can use "contains" with the distinguishedname (even use the AADconnect synchronization to put portions of distinguished name in an extended attribute if you so wish)

 

I have not had as much luck with devices. distinguishedname is not exposed as a dynamic device property. It seems that extendedattributes is not exposed as a device metaverse for synchronization so that puts that one out. I cannot see an "unused" variable in the device properties that I could hijack either. The closest I have found is devicephysicalids which is a string list. I suppose I COULD form an expression that gets the proper devicephysicalids and appends my own distinguished name so I can use that in the dynamic group - my googlefu on getting the proper devicephsyicalids has failed me (and appending would not be a good idea as it would append each sync iteration!). I have a thought about a graph API updating an extendedattributes with the distinguised name but im not sure how to automatically trigger this. My final idea is to have a scheduled task script that will sync an OU to a security group but this is a bit janky.

 

Any out of the box thinking? Currently we have a static security group for PCs in our OUs that we add devices too, this gets forgotten of course.

 

we dont have SCCM either (which will do this for you with co-management I believe).

Edited October 7, 2022 by KK20

[Steve21]

I’m assuming you mean hybrid devices? As azure wouldn’t have an OU

 

If so we use dynamic group devices using displayname

 

(Device.displayname -startswith “example”) etc, just type it rather than pulling drop downs

 

 

And as our devices in OU are named per room it works fine

 

That kind of thing?

 

Steve

[KK20]

correct. We have on prem AD with hybrid Azure join for all our devices.

 

It is one thought to edit the synchronization of devicename to prefix the OU, this would be dynamic per sync too. I will look up the ramifications of having a different devicename in AD vs AAD for the same device.

Edited October 7, 2022 by KK20

[TechMonkey]

What are you trying to achieve? What is your end goal?

[KK20]

a dynamic group populated with pcs that reside in an ou.

 

so if I have a dn of OU=COMPUTER_ROOM_3,OU=TRAFFORD_BUILDING,OU=PCS,DC=ETC,DC=COM and I have a 365 dynamic security group computerroom3_trafford_pcs then I want the group to be kept up to date depending on the OU. Therefore a dynamic 365 group being kept up to date with an on prem OU.

 

currently I have a static group that I add pcs manually. This is not ideal. The groups are going to be used in intune for software installations. Since we are hybrid I am still managing OU onsite. I intend migrating GPOs to intune starting with software installs.

Edited October 7, 2022 by KK20

[Mr.Ben]

Edit :deleted

[chaplic]

I was toying with some sort of Azure AD connect rule to transpose Dn to something else but I think your best option is just a PS script to remove/ add machines from AD groups depending on OU and just have it run on a DC or similar.

[KK20]

I couldnt find a "space" in the synchronised metaverse for devices that would also appear in the dynamic group available properties. Only devicephysicalids . Even more worrying is that onside AD extensionattributes DO NOT automatically sync up! I would have been happy to have an onsite scheduled task update local extensionattributes and have them naturally sync up, even changing in attribute editor, force a sync and wait will show nothing.

 

Only graph APIs seem to update AAD extensionattributes for devices. For Users you can happily syncrhonise the DN to extensionattributes of course as the AAD user metaverse exposes that to the sync tool.

 

Sadly an onsite scripted group seems to be the only way to go albeit simple to do:

 

dsquery computer "ou=computers,dc=MyDomain,dc=com" | dsmod group "cn=Test Group,ou=test computers,dc=MyDomain,dc=com" -chmbr

Edited October 10, 2022 by KK20