Azure Active Directory Dynamic Memberships

This feature requires an Azure AD Premium P1 license or Intune for Education for each unique user that is a member of one or more dynamic groups.

https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-create-rule

You can configure the BSN security groups in Azure as a dynamic group.  These are the how-to guides from Microsoft.

https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-tutorial

https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership

These are the example expressions you can use to add active Azure users to the dynamic group.

(user.mail -ne Null) and (user.accountEnabled -eq true) and (user.userType -eq "Member")

(user.assignedPlans -any (assignedPlan.capabilityStatus -eq "Enabled")) and (user.mail -ne null) and (user.accountEnabled -eq true)

Using Dynamic Groups in Azure AD to populate BSN Groups

Using dynamic groups within Microsoft’s Azure AD you can populate these groups based on user attributes.  Recently Microsoft has extended dynamic groups to utilize the memberOf property of a user, which now allows “Nested Groups”.

https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-rule-member-of

A new BSN group can be created, or an existing BSN Group can be modified.  When creating a new group, change the membership type from Assigned to Dynamic User.

When modifying an existing group, you would select the group and choose properties, changing the Membership type from assigned to Dynamic User

Once the group is created or modified you then need to add a dynamic query.  You can create the group based on an attribute, for example, userType being equal to member.  This can be done by the rule creator

However, if you would like to use nested groups to include the group All users, you would need to use the edit rule syntax screen as memberOf is not currently supported by the rule creator.  You can combine up to 500 groups into this dynamic group.  It is required to use the objectID of each group and you can used the following rule

Substituting the groupId of the group or groups you would like to include where it says groupId in the rule syntax.

This method can be utilized for any of the BSN groups.  This can also be a very powerful tool for creating and maintaining Tags.  You can create BSN-Tag-XXXXX based on existing groups or attributes.  Be mindful that a user can only maintain one group in the BSN portal, so the first group read would be the Tag that the user was assigned.

Note: you should ensure that all the users currently assigned to the “Assigned” group are covered by the “Dynamic” group rules, otherwise this could result in the temporary disabling of the users.

See also:

Azure Active Directory Sync - Simple Setup

Azure Active Directory Sync - Classic Setup

Using Dynamic Groups in Azure Active Directory to Populate BSN Groups

Breach Secure Now Confidential - For use with resellers and customers only and should not be redistributed or disseminated.