Combining On-prem AD groups with Sharepoint Teams Enabled sites

Details
Category: Microsoft 365

By default on-prem AD groups do not work flawlessly with Sharepoint sites with teams enabled. 
You can put the AD group for access to the site through the site memberships, but you cannot add the group for Teams access. 
This can be solved by using dynamic groups in Entra AD.

This solution assumes you use on-prem AD to give users access to sharepoint sites. Otherwise there is no real reason to apply this.

  1. Login to Entra ID (https://entra.microsoft.com)
  2. Go to Groups > All Groups
  3. By default, Teams enabled sharepoint sites automatically make a group for you with the same name as the site. Use the searchbox to find the group and open the properties
  4. Inside the properties, select Properties
  5. Set Membership type to Dynamic User and then click on the Add dynamic query
  6. At this stage the Memberof property isn't available yet as a dropdown option so you will have to enter your own query, click on the Edit button on the right side of the text box
  7. Enter the following query in the Rule syntax box
    user.memberof -any (group.objectId -in ['<object id of AD Group>'])
    You can find the ObjectID of the AD group by searching for it in the list of groups in Entra ID
  8. Click Ok when done and then Save 
  9. Depending on the size of the AD group it could take a second or minutes for the group members to start populating

Because this group is automatically known as a Sharepoint Site, all the users in your AD group will be added to the teams group so users automatically get access to the the teams group and through the members group in sharepoint they also get added there for access to the site. All dynamically and only by making changes to the AD group.