Migrating Nested Groups when Entra ID is the Identity Provider

When you sync a group from Active Directory to Workspace ONE UEM, all its users as well as users that belong to the nested groups under it are synced. In Workspace ONE UEM, the group is flattened and all the users become part of the top-level group that was synced. The nested groups do not appear in Workspace ONE UEM, unless they are explicitly synced.

Groups are not synced the same way from Microsoft Entra ID. Because Microsoft Entra ID does not support provisioning of nested groups, you cannot simply assign a group to the provisioning app and expect that users from all levels of the hierarchy under it will be provisioned to Omnissa Identity Service and Workspace ONE UEM.

To support the migration of Active Directory nested groups, Omnissa Identity Service provides a solution using dynamic groups in Entra ID. If your Active Directory has nested groups, to bring over all the groups' user members to your Omnissa Identity Service directory, you must follow this procedure as a prerequisite to migration.

Note: Any reference to users in this topic refers to users that are members of a group, not users that are synced individually.

Overview of the process

1. Verify that all users and groups that are currently being synced from Active Directory to Workspace ONE UEM have been synced from Active Directory to Entra ID.

2. Make a list of all the groups that are synced directly to Workspace ONE UEM from Active Directory and identify all the parent groups in it. A parent group is defined as any group that contains another group.

3. For every parent group that is synced directly to Workspace ONE UEM, create a corresponding dynamic group in Entra ID.

   • Map the dynamic group to its corresponding Active Directory group using the distinguishedName attribute in the group description.
   • Set dynamic rules so that the dynamic group includes users that belong to the corresponding Active Directory group as well as all the nested groups under it (at all levels). A nested group is defined as any group that has a parent group.

4. Assign the dynamic groups to the provisioning app.
   Important: Assign only the dynamic groups. Do not assign the corresponding Active Directory groups. Never assign both groups.

5. Assign to the provisioning app the remaining security groups that are synced directly to Workspace ONE UEM and that only have direct user memberships (and no nested groups).

Example

In this example, Group A is synced directly from Active Directory to Workspace ONE UEM, and its users as well as users from all the nested groups under it get synced to Workspace ONE UEM by default. To replicate the process from Entra ID, you would create a dynamic group corresponding to Group A and set dynamic rules to include all users from the Group A hierarchy.

Prerequisites

• You have an administrator role in Entra ID.
• Verify that all users and groups that are currently being synced from Active Directory to Workspace ONE UEM have been synced from Active Directory to Entra ID.
• Make a list of all the groups that are synced directly to Workspace ONE UEM, and identify all the parent groups in the list. Also note the distinguishedName of each parent group.

Procedure

1. Log into Microsoft Entra admin center as an administrator.

2. Navigate to the Groups > All groups page.

3. Click New group to create a dynamic group corresponding to one of the parent groups that is synced directly to Workspace ONE UEM.

4. Enter the following information for the new group:

   • Group type: Select Security.

   • Group name: Enter a name for the group.

   • Group description: Enter the following information to map the dynamic group to its corresponding Active Directory group:

   <urn:ietf:params:scim:schemas:extension:ws1b:2.0:Group:distinguishedName:ADgroupDN> additionalDescription
   

   where ADgroupDN is the distinguishedName of the corresponding Active Directory group and additionalDescription is your description of the group.

   For example:

   <urn:ietf:params:scim:schemas:extension:ws1b:2.0:Group:distinguishedName:CN=ACME-Users,CN=Users,DC=acm,DC=admin,DC=dc,DC=acmecorp,DC=com> This group contains all the admin users.
   

   

   • Membership type: Select Dynamic User, then click the Add dynamic query link to specify the dynamic group rules.

   1. In the Dynamic membership rules page, click Edit next to the Rule syntax box.

   2. In the Edit rule syntax page, enter the following rule in the Rule syntax box:

      user.memberOf -any (group.objectId -in ["group1id", "group2id", "group3id"])
      

      where group1id, group2id, and group3id are the Object IDs of the corresponding Active Directory group and all nested groups under it (at all levels).

      For example:

      user.memberOf -any (group.objectId -in ["f7f04c4f-fca4-b956-83a5f2d3cc", "bf3307bc-d232-4f82-c5e15294b1", "00a1ff94-2036-4d4a-ccb661195d"])
      

      You can find a group’s Object ID on the group’s Overview page in the Entra ID admin center.

      Caution: Add only group IDs to the dynamic groups. Do not add user IDs.

      

   3. Click OK, then click Save.

5. Click Create to create the group.

   Note: Wait until the dynamic rule is processed and users are added to the group. This process might take some time, especially for large groups.

6. Verify that the users in the dynamic group match the users in the Workspace ONE UEM group.

   1. Select the dynamic group in the Entra ID admin center, then select Members in the left pane.

   2. Verify that the users match the Workspace ONE UEM users.

7. Assign the dynamic group to the provisioning app you created to provision users and groups to Omnissa Identity Service.

   See Provisioning Users to Omnissa Identity Service for information.

   Important: Assign only the dynamic group to the app. Do not assign the corresponding Active Directory group.

8. Repeat the above steps to create and assign a dynamic group for each parent group that is synced directly to Workspace ONE UEM.

9. Assign the remaining security groups that are directly synced to Workspace ONE UEM and that only have direct memberships (and no nested groups) to the provisioning app.