Join Log in
Score:0
ricardovand3rlinden avatar Server

How to add AAD SG GroupMembers to an EXO DG and compare

it flag
ricardovand3rlinden

Currently I'm busy with a script that needs to do the following:

The script need to check the Azure AD group and compare mutations in an EXO DG. I have write and bundle some in and out puts, but I can't make it to work. I have zero errors when running, but a deleted user from the SG group will not be deleted from DG in EXO.

Why I'm doing this? I have an open question to make an Azure AD Security Group mail-enabled. Unfortunately, Azure AD Security Groups cannot be mail-enabled groups.

On 'New-AzureADMSGroup' or 'Set-AzureADMSGroup' there is a MailEnabled object, but not supported.

Having an EXO MSG, just don't fill the needs, because you cannot use this group within Access Packages or Enterprise Applications.

Having an EXO DDL, also don't fill the needs, because the users in the requested AAD SG, just don't have the same criteria to filter on. The only thing the users have in common, is the membership of the AAD SG.

#Azure AD
$AzureADGroup1 = "xxxxx-xxx-xxxx-xx-xxxxxxx"
$AzureADGroup1Members = Get-AzureADGroupMember -ObjectId $AzureADGroup1 -All $true | Select-Object Mail

#EXO
$DGMembers = (Get-distributiongroupmember -identity [email protected]).primarysmtpaddress

foreach ($AzureADGroup1Member in $AzureADGroup1Members) {
#if users already added returns $false
if (!($DGMembers -match $AzureADGroup1Member))
{
Add-DistributionGroupMember -Identity [email protected] -Member $AzureADGroup1Member.Mail -Confirm:$false -ErrorAction SilentlyContinue
}

Write-Host -ForegroundColor Green $AzureADGroup1Member.Mail"is added"

if (!($DGMembers -notmatch $AzureADGroup1Member))
{
    Remove-DistributionGroupMember -Identity [email protected] -Member $AzureADGroup1Member.Mail -Confirm:$false -ErrorAction SilentlyContinue
}

Write-Host -ForegroundColor Green $AzureADGroup1Member.Mail"is removed"

}

UPDATE: I have now made another script, which is not very neat.

1: Removes all members from DG

2: Retrieves all members from AAD SG

3: add all members back to DG

#EXO: Clear DG

$DG = "DG1"

$DGMembers = (Get-distributiongroupmember -identity $DG).PrimarySmtpAddress



foreach ($DGMember in $DGMembers) {

    Remove-DistributionGroupMember -Identity $DG -Member $DGMember -Confirm:$false -ErrorAction SilentlyContinue

    Write-Host -ForegroundColor Green $DGMember "is removed"

}



#Azure AD: Get AAD SG

$AzureADGroup1 = "xxxx-xxxx-xxx-xxx-xxx"

$AzureADGroup1Members = (Get-AzureADGroupMember -ObjectId $AzureADGroup1 -All $true).Mail



#EXO: Fill up DG again

foreach ($AzureADGroup1Member in $AzureADGroup1Members) {

    Add-DistributionGroupMember -Identity $DG -Member $AzureADGroup1Member -Confirm:$false -ErrorAction SilentlyContinue

    Write-Host -ForegroundColor Green $AzureADGroup1Member "is added"

    }

Well that in itself is not a problem, only that the AAD SG has more than 1100 members, I can of course run it at 1 o'clock every night, but I'm afraid that he may not be ready at 7 o'clock in the long run.

48
0 + 0
Score:0
ricardovand3rlinden avatar Server
it flag
ricardovand3rlinden

I answer my own question for future readers. The key is to work with Compare-Object function in PowerShell!

#Azure AD: Get AAD SG
$AzureADGroup = "xxx-xxx-xxx-xxx-xxxx"
$AzureADGroupMembers = (Get-AzureADGroupMember -ObjectId $AzureADGroup -All $true).Mail

#EXO: Get EXO DG
$DG = "[email protected]"
$DGMembers = (Get-distributiongroupmember -identity $DG).PrimarySmtpAddress


# SideIndicator: "<=" = NOT IN EXO DG - ADD AAD SG GROUPMEMBER TO EXO DG
Compare-Object -ReferenceObject $AzureADGroupMembers -DifferenceObject $DGMembers | Where-Object {$_.SideIndicator -eq "<="} | ForEach-Object {
    Add-DistributionGroupMember -Identity $DG -Member $_.InputObject -Confirm:$false
    Write-Host -ForegroundColor Green $_.InputObject "is added"
}

# SideIndicator: "=>" = NOT IN AAD SG - REMOVE EXO DG GROUPMEMBER FROM AAD SG 
Compare-Object -ReferenceObject $AzureADGroupMembers -DifferenceObject $DGMembers | Where-Object {$_.SideIndicator -eq "=>"} | ForEach-Object {
    Remove-DistributionGroupMember -Identity $DG -Member $_.InputObject -Confirm:$false
    Write-Host -ForegroundColor Green $_.InputObject "is removed"
}

Write-Host -ForegroundColor Green "Script is finished!"

You can fill the DG one time with:

#Azure AD: Get AzureADGroup1 and AzureADGroup1Members
$AzureADGroup1 = "xxxx-xxx-xxxx-xxx"
$AzureADGroup1Members = (Get-AzureADGroupMember -ObjectId $AzureADGroup1 -All $true).Mail

#EXO: Set DistributionGroupMembers from AzureADGroup1Members in AzureADGroup1
foreach ($AzureADGroup1Member in $AzureADGroup1Members) {
Add-DistributionGroupMember -Identity [email protected] -Member $AzureADGroup1Member -Confirm:$false
Write-Host -ForegroundColor Green $AzureADGroup1Member "is added"
}

Write-Host -ForegroundColor Green "Script is finished!"

After the one time fill, you can make an automation task that compare both groups each day.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.