Members and owners of AADMSGroup

[bartvermeersch]

Hello

What are the current options or what will/should be developed to specify Azure AD group members and owners?

Can it be integrated in MST_AADMSGroup (similar to MSFT_O365Group), are we waiting for AzureADMSGroupMember cmdlets to become available or do we need to develop a MSFT_AADGroupMembers module?

Thanks!

[NikCharlebois]

@ykuijs @desmay @ThorstenLoeschmann thoughts on whether it should be included in AADMSGroup or become its own resource?

If we keep them separate, it makes it easier to clone environments where we can recommend that folks only export the Groups and not the memberships.

[ykuijs]

@NikCharlebois I would say to integrate it into this resource, like the O365Group. That makes most sense to me, since it captures all "settings" of the group into one resource.

[andikrueger]

As far as I know, this enhancement is already implemented. There are ManagedBy (Owners) and Member attributes available. see: https://microsoft365dsc.com/resources/office365/O365Group/

@ykuijs @NikCharlebois @bartvermeersch Can you confirm?

[bartvermeersch]

@andikrueger if I'm not mistaken, this is only implemented for Unified groups, not Azure AD security groups
(MST_AADMSGroup vs MSFT_O365Group)

[andikrueger]

That’s right and matches the discussion above.

would be doable to extend AADGroup with the members and additional data.
What’s the use-case behind this requirement? Any further detail would be good to better understand the scenario for the additional properties.

[bartvermeersch]

We want the membership of certain Azure AD groups to be "managed/controlled" using DSC (to have a history, backup of as-is, consistency over multiple tenants ...).

[bartvermeersch]

An additional question: When comparing O365Group and AADGroup, I noticed that O365 is happily continuing when detecting multiple groups with the same displayname (taking the random first occurrence) while AADGroup is throwing an exception.

Shouldn't this be consistent and if so, what is the preferred choice? To me an exceptions seems the better option.

elseif ($ADGroup.Length -gt 1)
{
     $Message = "Multiple O365 groups were found with DisplayName {$DisplayName}. Please specify the MailNickName parameter to uniquely identify the group."
     New-M365DSCLogEntry -Error $_ -Message $Message -Source $MyInvocation.MyCommand.ModuleName
}
...
ADGroup[0]
...

In contrast with

if ($Group.Length -gt 1)
{
     throw "Duplicate AzureAD Groups named $DisplayName exist in tenant"
}