Sharing Canvas Apps with a Dynamic Group

[bfausti]

I am trying to share a canvas app with a dynamic group in Azure AD, but get the follwoing error message:

The request failed with error: '{"error":{"code":"0x80040203","message":"The group whose AzureActiveDirectoryObjectId = 8b2e08d8-d2cb-459d-8d1c-9132cc564d14 is not an AadGroup or OfficeGroup, the attribute GroupTypes are = DynamicMembership. "}}'. The tracking Id is '95c1c4df-76a2-4e35-b8ee-bbde5efd37a8'.

Is it not possible to share with dynamic groups?

[poweractivate]

@bfausti 

This specifically is not supported, we believe.

However in case someone else on this forum thinks this is possible or supported though, even if it is by workaround - please feel free to chime in. We do not know of any workaround for this specific requirement to use a DynamicMembership type group.

[bfausti]

Thanks. Do we know if this will be supported in the future?
The issue is we need to automatically assign new guest users to a group which has access to specific canvas apps. Is this achievable another way automatically?

[RandyHayes]

@bfausti 

You will need to set the Group as a Security group, then you can set it in PowerApps.  

However, this is the case with ANY group in AD, if you convert to Security group (or I should say "add"), then you can use it.  But, I've not tested specifically for Dynamic Membership groups.

I'd try to convert to security group (you'll need to use PowerShell to do this) and see if that offers any help for Dynamic Member groups.

I hope this is helpful for you.

[bfausti]

Thanks @RandyHayes, but this does not solve my issue of automatic group assignment of users. Is there another way to automatically assign users to a group when they are added to the AD? (Not using the bulk method).

[RandyHayes]

@bfausti 

I'm confused...I thought you were trying to share with a dynamic group and getting the error.

If you want to create a dynamic membership group, then yes, this is all possible in Azure AD.  You just need to convert the group to Dynamic Membership and then create a Rule to assign users.

[bfausti]

So my end goal is to automatically assign users to groups when they get added to the AD and then share that group with my Canvas app @RandyHayes. I can achieve the first half but not the sharing of the dynamic group with canvas. I will try your suggestion of creating a dynamic membership group and see if that works. 

[bfausti]

Looks like sharing of canvas apps with dynamic groups (ie Groups with Membership Type = Dynamic User) is not supported. Can someone please confirm this is the case?

[radityoardi · Accepted solution]

I've came across this post to find the answer of the same question, but then I realized I was able to share to a group. After digging more, sharing the app directly to a dynamic group is not possible but doing it indirectly is okay.
You will need to "encapsulate" your dynamic group as a member of an assigned group in Azure AD. This works perfectly fine in my case.

Hope this helps anyone looking for the same answer. 😉