MS365 – Azure AD – Dynamic Groups and Expiration Settings

Maintain groups in Azure AD with dynamic groups and set expiration settings.

Example scenario : Controlling remote access to sub contractors working on a short term project. The project owner should remove all access for sub contractors after the project completes

How to guide :

If we combine Dynamic Groups and Expiration settings, we can automatically populate groups and then invoke regular check to maintain groups are still required. Group owners will be reminded regularly to verify groups are required. Owners will have a better understanding of who has access and this help assist with your security policies.

Dynamic Group Example

Steps: Azure Active Directory > New Group > Type : Office 365 > Name, Description, Dynamic User > Owner > Dynamic user Members

Group Name : Sub Contractors    – Set the value for department equals “Sub Contractor”

Dynamic User Members    – Add Experssion

(user.department -eq “Sub Contractor”)

Configure Group lifetime / Expiration Settings

Steps: Azure Active Directory > Groups > Expiration > Days > No Owner email > Selected > Group > Save

“Renewal notifications are emailed to group owners 30 days, 15 days, and one day prior to group expiration. Group owners must have Exchange licenses to receive notification emails. If a group is not renewed, it is deleted along with its associated content from sources such as Outlook, SharePoint, Teams, and PowerBI.” Info from the portal Expiration settings.

In Office 365 Add users automatically to a group based on property

Dynamic membership rules for groups in Azure Active Directory and automatic licensing.

Configured in Azure Active Directory Admin Center.

Add New Group


Select Dynamic User or Device

 

Example Looks for a property “Sunderland”

Users created with City “Sunderland”, will be added automatically to this group.

Next step, edit the Group “Sunderland Office” by clicking on it.

Click “Licenses” and “+ Assignments”

Select the license and options to assign and save

For more information visit

https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership