Azure AD Provisioning: Nested groups in Azure AD groups are not provisioned

[AdrianHolm]

Hello,

Referring to On Azure, synchronizing nested groups (groups with groups inside) into ServiceNow imports empty reco...

We've configured provisioning from Azure AD to ServiceNow, and all works well. However, in some of our Azure AD groups we have groups that are members. Like this for example;

• Group = role.azuread.employee
• Members = Karen Olsen, Aidan Petro and role.azuread.part-time.employee (Group in Group)

As you can see in the exmaple, we have 2 users who are members and 1 group that are member, but it is only users that are synced to sys_user_grmember. Does anyone know if it's possible so also fetch groups? 

As of on-prem AD we were able to have Nested Groups, because this value vas stored in the member attribute on the group. With this, we have a script that removes all users with specified OU location in AD, and remains with the nested groups. We then could connect nested groups in groups, but in Azure AD - this seems impossible?

This is how it looks like after provisioned;

And this is how it looks like in sys_user_grmember.list;

Please let me know if anything is unclear!

Best regards,
Adrian Holmestrand

[AdrianHolm]

Tried with another Azure AD group, it's stille the same. In sys_user_grmember it shows this;

So apparently, it seems that when there are nested groups in Azure AD group - it thinks it's a user and therefore create a new user? 

[AdrianHolm]

And, when I try to access the user, it shows this (which is normal behaviour);

[Marcel H_]

I had the same issue recently and didn’t realize that the “user” was a nested group. I wonder if the groups are synced first and then nested on both Azure and SN if they would work as expected and sync users properly. I’ll test in my PDI and post back when I have a chance.

[USNOOZEULOOSEY]

I have the exact same issue although we never implemented ours via AD and therefore only ever had this issue occur from AAD sync. We can see the parent group in Snow but we cannot see any sub group or users in those sub groups. Very frustrating as we want to clean up our user permissions as we still grant our access via security groups on-prem which syncs to AAD before provisioning to Snow. 

It seems as though there is no re-occurring lookup for sub groups.

I hope someone from Snow helps soon, no one seems to know much about Snow, even Snow engineers 😞  (or at least volunteer to help)