Entra Groups

Copy/Paste Quick Reference

azuread_group = {
    ExampleGroup = {
        display_name            = "Example Group",
        description             = "Creates a user group in entra",
        security_enabled        = true
    }
}

Overview

This module allows you to create Entra groups for managing users and permissions. Most often you will use this module for assigning roles and permissions to a group of users, but Entra groups have other use cases that might apply. The display_name is what the group will show up as in Entra. Create a concise description for communicating the group's purpose for others modifying our tfvars and customer admins. If the group will be used for role assignments, set security_enabled = true.

Creating Entra groups in terraform uses the azuread resource provider instead of the azurerm resource provider used by most of our other modules. Non azurerm resources should include the provider name in their module name, such as azuread_group. See terraform documentation here for more information.

Permissions Required for TF Service Principal

To create and manage Entra groups, the service principal used by terraform must have the Groups Administrator or User Administrator role.

Dynamic Group Memberships and Nested Groups

Entra groups can be configured with dynamic membership rules, primarily to automatically assign devices to groups for Intune administration or managing user flows in Office 365. For most of our use cases, this is not recommended as these groups will be primarily used to manage privileged access. Groups can also be nested, but assigned roles are not inherited by nested groups.

Microsoft currently has the dynamic group membership attribute memberOf in preview that allows groups to automatically include users that are members of a different, existing entra group. This would allow us to create dynamic rules for customer owned and controleld entra groups to include those users in our terraform defined groups for assigning RBAC. When this feature is availble, we will be able to independently manage access to the cloud resources we manage for customers, which makes this module much more useful. It is the answer to nested groups being unable to inherit role assignments. See MSFT documentation on this preview feature here.