Security Policy Errors

How to Assign an Azure Role to an On-Premises Active Directory Group

Guest Writer Oct 7, 2026 870 views

Question details

The user needs to assign an Azure or Microsoft Entra role to an on-premises Active Directory group but is facing limitations.

How to Assign an Azure Role to an On-Premises Active Directory Group

Product: Microsoft Azure / Microsoft Entra ID
Device & OS: not provided
Scenario: Configuring hybrid group role assignments to grant Azure resource access to on-premises identities.
Observed behavior: Azure or Microsoft Entra roles cannot be assigned directly to an on-premises Active Directory group, and Microsoft documentation indicates groups cannot be added as members of a role-assignable group.

Before you start

Ensure you have Global Administrator or Privileged Role Administrator permissions in Microsoft Entra ID, and verify that your on-premises Active Directory is syncing correctly via Azure AD Connect.

Solution 1Recommended

Use a Cloud Security Group as an Intermediary

Create a role-assignable cloud security group and assign the Azure role to this group, then populate it with the appropriate synchronized users.

Because Azure does not support assigning roles directly to on-premises AD groups, you must utilize a cloud-native security group.

Note that Microsoft currently restricts adding groups as members of a role-assignable group. Therefore, you must add the individual synchronized users to the cloud group rather than nesting the on-premises group inside it.

Create a Role-Assignable Group

Sign in to the Microsoft Entra admin center. Navigate to Groups > All groups, and select 'New group'. Set the Group type to 'Security'.

Enable Role Assignments

Enter a group name and description. Under the 'Azure AD roles can be assigned to the group' option, toggle the switch to 'Yes'.

Add Synchronized Users

Click on 'No members selected' and search for the users synchronized from your on-premises Active Directory. Add these users to the new cloud group and click 'Create'.

Assign the Azure Role

Navigate to the resource, subscription, or Entra ID role blade. Open 'Access control (IAM)', click 'Add role assignment', select the required role, and assign it to the newly created cloud security group.

Use a Cloud Security Group as an Intermediary

Nesting Limitations: Role-assignable groups in Microsoft Entra ID do not support nested groups. You cannot simply add the synced on-premises group as a member of the role-assignable cloud group; you must add the users individually.

Free Microsoft Office alternative

Boost Your IT Productivity with WPS Office

While you navigate complex Azure Active Directory configurations, managing your IT documentation, reports, and spreadsheets shouldn't be a struggle. WPS Office provides a lightweight, highly compatible, and free alternative to Microsoft Office for all your professional needs.

1. Download the Installer: Visit the official WPS website and click on the 'Download WPS Office Free' button.
2. Install WPS Office: Run the downloaded executable file and follow the straightforward on-screen instructions to complete the installation.
3. Manage Your IT Documents: Launch the application to seamlessly open, edit, and share your Microsoft Office-formatted IT reports and spreadsheets.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx)Lightweight application that uses minimal system resourcesFamiliar user interface for a seamless transition from Microsoft OfficeBuilt-in PDF editing tools ideal for managing IT infrastructure documentation

microsoft office alternative - wps office

Frequently Asked Questions

Can I assign an Azure AD role directly to an on-premises synced group?

No, Azure or Microsoft Entra roles generally cannot be assigned directly to an on-premises Active Directory group due to fundamental security boundaries and architecture differences.

Can a role-assignable cloud group have other groups as its members?

According to Microsoft's security policies, a role-assignable group cannot have other groups as its members. You must assign individual users or service principals directly to the role-assignable group.

What is a role-assignable group in Microsoft Entra ID?

It is a specialized cloud security group in Microsoft Entra ID that has the 'Azure AD roles can be assigned to the group' property enabled during creation, allowing it to be securely used for role-based access control (RBAC).

Microsoft Office Security Issues