AzureAD Role Delegation to Groups
Currently in AzureAD msolroles can only be assigned to users and servicePrincipals using the add-msolRoleMember cmdlet. Groups cannot be a msol-roleMember - although the add-msolroleMember cmdlets' RoleMemberType Parameter can be set to Group. But we always get an exception which says that this value is invalid....
Usually we delegate access to resources using ActiveDirectory Groups instead of users, which makes the Management much easier. To achieve a Role Delegation to Groups we have to deploy a Powershell that synchronizes Group-Members with Role-Members of a specific role. This is a valid Workaround but a nasty one compared to a direct delegation to AzureAD Groups.
Pirmin Felber
shared this idea
Just wanted to post another update that this is a high priority, but we do not have any details to announce yet.
Cheers,
/Stuart and Vince
44 comments
-
Anonymous
commented
Is there anywhere where you've posted about the specific concerns around elevation of privilege (especially since this only seems like an issue with Azure AD, unless I'm missing something)?
Not being able to manage roles by groups seems like such a feature gap (per comments from others on here) that I'm struggling to explain it internally - it makes it seems like I'm making it up!
-
Folks,
We are working on it. There is an elevation of privilege concern associated with this feature. If a group is assigned a role, any IT admin who can manage group membership can indirectly manage the membership of that role. So, we have to ensure that the feature is secure.Stay tuned!
Regards,
Abhijeet Kumar Sinha
Azure Active Directory Team -
Anonymous
commented
Hi Team,
Can you please update on this feature as it is requested by lot of clients and this need to be done on priority.
-
Nicholas Hart
commented
Customers are begging for this feature , please can we have the ability to manage roles via group membership ?
Or at least a commitment for an ETA on this needed feature ?"high priority"
-
Anonymous
commented
Is there any ETA on this? Soon a year since you replied that this is a high priority.
-
Jiri Formacek
commented
Hello, any update on this feature availability?
-
Bhargav Patel
commented
Any update on this? This is a big shame, we have RBAC but not for the most important piece of service.
-
Tor
commented
This is very much needed! Eagerly anticipating some progress on this topic.
-
Adam
commented
any update,, the fact that this basic principle of security and IAM was left out of AAD roles , makes me question our move this!!!
-
Anonymous
commented
Is there any news?
-
Anonymous
commented
When is this basic capability going to be added into the system. Its absurd that it was skipped.
-
Volz, Gary
commented
Azure Active Directory doesn't support group assignment to roles? How much more contradictory does it get? An enterprise directory doesn't support enterprise management.
-
Anonymous
commented
Do you have any news about this feature of support of AAD security groups in a AAD Roles ?
-
Anonymous
commented
Would like an update on this.
-
Todd Johnson
commented
It's been ~7 months since last update. MS, can you provide another update please?
-
Christian Wiese
commented
Agree with the others. Not having this feature really goes against RBAC fundamentals and increases management overheads for our IT department.
Microsoft please resolve asap.
-
JasonG
commented
is a reference item for the planned work available so customers can look for updates and status, if not is this possible?
-
Lamb, Jeff
commented
Any updates?
-
Andrew Thompson
commented
bump... same as everyone else here.
-
Ben Gliddon
commented
Agree with the others. Not having this feature really goes against RBAC fundamentals and increases management overheads for our IT department.
Microsoft please resolve asap.