azurepermissionsactive-directoryazure-active-directoryaz

Ownership and inheritance within nested groups

If a user is an owner of Group1 and Group2 is member of Group1. My understanding was, user would be able to get ownership rights on Group2 also? I was trying to move the Onprem AD groups to Azure AD, was not sure how this will work. Any ideas? Please add any related articles. Thanks

Solution

  • My understanding was, user would be able to get ownership rights on Group2 also?

    No, the user will not be able to get the ownership rights on Group2.

    Looks there is no doc for the specific scenario, but I did a test to confirm it. I have a user account which is an owner of Group1 and Group2 is a member of Group1, then I use powershell Add-AzureADGroupMember to add another user to the Group2 as a member, I got the Insufficient privileges to complete the operation, it means the user does not have ownership on Group2.

    enter image description here

    enter image description here

    enter image description here

    I was trying to move the Onprem AD groups to Azure AD, was not sure how this will work. Any ideas?

    You could use Azure AD Connect to sync the on-prem AD groups to Azure AD, also see the important points to be aware of when synchronizing groups from Active Directory to Azure AD.