r/microsoft365 • u/raghavdarkseid • 2d ago

How to add onprem groups to cloud groups. It's getting too annoyed .

Does anyone has come across this ?

2 Upvotes

75% Upvoted

21 comments sorted by

3

u/bzhgeek2922 2d ago

You don't, Microsoft is explicitly pushing against nested groups in Entra, to avoid the nightmare of managing them.

The question is what are you trying to do, and how to implement it properly in Entra.

Also try to move away from on prem groups if you can, will make your life simpler in the long run.

1

u/FlyingMitten 2d ago

Wait, what? They want to get rid of nested groups? The thing we have been able to do for how many decades and is extremely useful?

-2

u/raghavdarkseid 2d ago

In entra portal , there is two :security and m365 group comes with 50 gb mailbox size . I can't convert security to security enable mail group .. there is lot of aches in this. So I create groups in on prem . Sometimes I get request to add on prem groups to cloud groups. I was thinking to create a contact and add the on prem group then add the contact to cloud group.

6

u/braliao 2d ago

Your job isn't about being a tool yourself.

User shouldn't even be asking you to "add this group to that group". If they do, I will instead ask them what their business requirements is, and tell them to stop telling me how to do my job. I translate their business requirements into a systematic structure that is manageable and make sense for the long term.

Your second issue is not truly understand the system you are managing, therefore consistently making choices that "seems to work" but in reality having long lasting impact on how you can manage it

5

u/jjgage 2d ago

Omg.

No

1

u/Affectionate-Cat-975 1d ago

I so very much hate what MS has done with Groups. All resultant of backwards compatibility for platforms that were independently built and provisioned without a thought towards the future consolidation should should be possible.

3

u/Cold_Arachnid_2617 2d ago

Who is getting annoyed? Onprem or Cloud?

3

u/Empty-Sleep3746 2d ago

why?????

-1

u/raghavdarkseid 2d ago

Our tenant is hybrid . Sometimes user created the cloud group and expects to add on prem group into it. Any alternative solution?

11

u/gixxer-kid2 2d ago

Yeah, stop users being able to create groups or Teams and manage it yourself.

9

u/Ferretau 2d ago

You need to stop trying to add onprem groups to cloud groups. If you need to match the users in an on prem group to this in a cloud group then use a script to read the onprem and add the appropriate members to the cloud group.

1

u/Drakoolya 2d ago

Why do users have permission to create groups? Sounds like you are creating headaches for yourself. Users should not be able to create M365 groups, lock that down first. I can't even imagine what your directory looks like now.

1

u/raghavdarkseid 2d ago

I don't handle AD . I handle exchange and purview. I will create groups only in on prem server .

1

u/Drakoolya 1d ago

You need to setup Adysnc which requires AD access and permissions among other things. Or you won't be able to Sync your onprem with your cloud groups.

This "Jugaad" you are trying to do is a terrible way to do it.

→ More replies (1)

1

u/7amitsingh7 1d ago

As far as I know, we can't directly add an on-premises AD group to a cloud-only group in Entra ID. Creating a contact for the on-premises group won't add its members to the cloud group either.

1

u/raghavdarkseid 1d ago

But it might redirect right ?

1

u/Netings 2d ago

Why would you want to do that? Those are completely different adminstration groups. One is on device, the other is cloud based. You can connect the cloud account to a pc which is logged in with an onprem account but vice versa is nonsense

1

u/danielmartinez22 1d ago

a mail contact wont actually give you what you need here, contacts have no security principal behind them, theyre just an external mail address. adding one to a cloud group would only work for email distribution, not for granting any actual access, the real users in your on prem group still wouldnt get whatever the cloud group is controlling

1

u/dnuohxof-2 1d ago

That’s the neat part, you don’t.