0 votes

We have a cloud app which can not use nested groups, and apparently doesn't like the Dynamic rules in Azure either. So I'd like to build the groups in AD and sync it to Azure, this is confimed working.

So basically to keep the group updated, I plan on running a scheduled task. This takes a bit to run through all my users, so if there's a better way, then please let me know.

  1. Add it to the group if your part of the department
  2. Add it to the group if you have the Extension 1 Attribute
  3. Remove from the group if neither are true.
If the user is a member of the 'DEP-Accounting (domain.com\Groups\User Department Branch Groups)' group then
      Add the user to the 'DTS-TEST-AUDT (domain.com\Groups\APP Security Groups\DTS)' group

If the 'Extension Attribute 1' property equals 'AUDT' then
      Add the user to the 'DTS-TEST-AUDT (domain.com\Groups\APP Security Groups\DTS)' group

If the user is not a member of the 'DEP-Accounting (domain.com\Groups\User Department Branch Groups)' group AND
   the 'Extension Attribute 1' property does not equal 'AUDT' then
      Remove the user from the 'DTS-TEST-AUDT (domain.com\Groups\APP Security Groups\ DTS)' group

I will also be running this for 5 different groups and trying to update daily. Each group have different users, and uses differnt IF statements. So is it best to have 5 different scheduled tasks kicking these off seperately, or should they be combined? Just overall looking for best way to keep them updated.

ago by (1.5k points)

Please log in or register to answer this question.

Related questions

0 votes
1 answer

We're delegating admin rights to our various IT departments, only giving them access over their stuff under their OUs. They're missing the option to see the group membership ... on user's management history, is there another approach that I'm not aware of?

asked Sep 18 by felix (150 points)
0 votes
1 answer

I'm trying to automate adding users who are enrolled in MFA to an AD group. The scripts I found elsewhere here that do not work so I believe they may have been written against a prior Adaxes version or referencing a report that does not meet our needs.

asked May 31 by neal (50 points)
0 votes
1 answer

Hi we are trying to add users to a group based on the values of their "Office" and "Description" attributes within Active Directory. We have populated the below ... $Context.LogMessage("No matching criteria found for User $($Context.TargetObject.Name).") }

asked Sep 18, 2023 by Loopy8822 (20 points)
0 votes
1 answer

For instance to execute a powershell script that enable MFA for all member in that group?

asked Jan 27, 2023 by samuel.anim-addo (20 points)
0 votes
1 answer

Hello, I have my OUs structured so each department we're working with has an OU for their service accounts under their department OU. e.g. OU=Service Accounts,OU=Sales,OU= ... add each new OU to the scheduled task but I was hoping for something more hands off.

asked Oct 19, 2015 by drew.tittle (810 points)
3,552 questions
3,242 answers
8,243 comments
547,828 users