Let’s discuss about the SCCM collection sync to Azure AD group. This feature got introduced in SCCM 1906 production version. In this video you will be able to see how to sync your collection with devices into Azure ready group (SCCM Collection AAD Group Sync).
NOTE! – I have given a live demo of the Collection Sync Feature in the two live Webinars which Parallels conducted recently. More details about the Webinars is available here.
SCCM 1906 version onwards you would be able to sync your SCCM collection and the devices inside that collection to Azure AD groups. This feature will help you to deploy modern policies to those Azure AD Groups. This feature provides helps to automate the Azure Group management.
SCCM will automatically take care of adding Azure AD devices into that group depending on your Collection membership. This feature can be used for static or dynamic collections.
Advantage of SCCM Collection AAD Group Sync
This SCCM collection sync feature is useful as SCCM can query devices based on many attributes and the devices dynamically into a collection. Azure AD dynamic groups are not that much capable for querying the complex attributes of devices.
So, grouping those devices based on complex attributes into a particular AAD dynamic groups is nearly impossible. The support of Azure AD dynamic groups and attributes allowed in dynamic groups are very limited if you compare it with SCCM.
So, you can use SCCM collection AAD Group sync feature to create very complex Azure AD groups. These groups can be used to deploy modern policies modern applications to those Azure AD groups.
The following prerequisite should be in place to get SCCM Collection AAD Group sync to work.
- SCCM Cloud Services configured correctly (Azure AD user/group sync)
- Enable SCCM Collection Sync
- The Device/machine should be Hybrid Azure AD joined (Domain Join + Azure AD Registered)
- AAD Connection configured and enabled for Hybrid Azure AD Join scenario
- SCCM server should have internet connection and connectivity to the URLs required for this SCCM Collection Sync (Graph API and all)
NOTE! – I found that if your SCCM server is behind a NATed network, then the SCCM cloud services won’t work as expected.
Create Azure AD group
You need to go to Azure AD and create a new group for SCCM collection sync to Azure AD group. This AAD Group will be assigned as your Azure AD group that means a static Azure AD group.
The owner of the AAD group should be the service principal or server application which you created in SCCM console when you created the cloud services and Azure AD discovery feature.
The owner is critical because that is the attribute which provides SCCM access to Azure AD groups. Otherwise the SCM won’t be able to add or remove devices from Azure AD group. So that owner is a basically a service principal which will provide SCCM server access to edit Azure AD groups.
Create a New Collection
To test this feature what you can do is create a new device collection from Assets and Complaints. Once the collection is created, you can go to the properties of that collection and click on AAD group tab.
- Once you are in that Azure Group Sync tab, you would be able to see your tenant detail and there is a search box over there.
- In the search box, you can search for Azure AD groups.
- And Select one of the AAD groups which you created for collection sync.
- Now add Azure AD group and click OK to continue.
Log File – SCCM Collection AAD Group Sync
Immediately SCCM should start syncing this device into Azure AD group which we created above. You can validate this activity from log file called as SMS_AZUREAD_DISCOVERY_AGENT.log.
Collection to AAD group sync worker starts.
Get group members for group: https://graph.microsoft.com/v1.0/groups/56f72f14-625a-4f7e-a299-8cbc200be430/members?$select=id&$top=500
Add device: c7b5bc39-ec90-44e8-9f83-3789317416bd to group 56f72f14-625a-4f7e-a299-8cbc200be430 in request 0
Sync successful, new Watermark: 2317
Collection to AAD group sync worker ends.