How do we identify the user's Azure AD group memberships?

Hi! Did you ever find a solution for this? 

I am trying to figure the same thing?  Anyone have any thoughts?

We were able to accomplish this using a 3rd party automation tool.  It's unfortunate that it's not available with the existing Jamf supported Azure integrations.  The workflow we have: 

1. Triggers via jamf webhook when a computer submits inventory information. 

2. Extracts the user from the jamf computer object. 

3. Queries AzureAD for that user's group membership. 

4. Filters results to AAD Group IDs only (Opinion: it's easier to work with group IDs than names)

5. Write the Groups IDs to an extension attribute. 

From there we are able to create smart groups based on Azure AD group IDs.  The tool we use is Torq.io but I imagine a similar workflow could be created using another automation tool.... or  eventually within Jamf Pro. 

That sounds like a nice workaround. I will try to do this using tines and see if it works! Thanks for the info.

This is the template extension attribute script that we use to poll Azure groups based registered email from setup assistant, Jamf Connect, or Microsoft activation. Just add your Jamf server, your API Client and Secret (Read LDAP Servers), and Azure groups. It will return TRUE or FALSE. We use these for Licensing groups that we smart group for scoping.

 

#!/bin/zsh --no-rcs

# VARIABLE DECLARATIONS
BASEURL="ORGANIZATION.jamfcloud.com/"
CLIENT_ID='XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'
CLIENT_SECRET='XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
EMAIL_ADDRESSES=()
loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' )
echo "USER=$loggedInUser"

# List of groups to search
Variable_LIST=(
"AZ_Group1"
"AZ_Group2"
"AZ_Group3"
)

# Run the result through dscl locally
REALNAME=$( /usr/bin/dscl . -read /Users/${loggedInUser} dsAttrTypeStandard:RealName | sed 's/RealName://g' | tr '\n' ' ' | sed 's/^ *//;s/ *$//' )
EMAIL=$( /usr/bin/dscl . -read /Users/${loggedInUser} dsAttrTypeStandard:NetworkUser | sed 's/NetworkUser://g' | tr '\n' ' ' | sed 's/^ *//;s/ *$//' )
bearerToken=""
tokenExpirationEpoch="0"

# Collect registered email addresses: dscl NetworkUser, Microsoft Activation email, Jamf Connect email
EMAIL_ADDRESSES+="${EMAIL}"
EMAIL_ADDRESSES+=$(/usr/libexec/PlistBuddy -c "Print :DisplayName" "/Users/${loggedInUser}/Library/Preferences/com.jamf.connect.state.plist" || echo "Does not exist")
EMAIL_ADDRESSES+=$(defaults read /Users/${loggedInUser}/Library/Preferences/com.microsoft.office.plist OfficeActivationEmailAddress)

# FUNCTIONS
getBearerToken() {
	response=$(curl --silent --location \
	    --request POST "https://${BASEURL}/api/oauth/token" \
	    --header "Content-Type: application/x-www-form-urlencoded" \
	    --data-urlencode "client_id=${CLIENT_ID}" \
	    --data-urlencode "grant_type=client_credentials" \
	    --data-urlencode "client_secret=${CLIENT_SECRET}" | plutil -extract "access_token" raw -)
	bearerToken="${response}"
}

invalidateToken() {
	responseCode=$(curl -w "%{http_code}" -H "Authorization: Bearer ${bearerToken}" https://${BASEURL}/api/v1/auth/invalidate-token -X POST -s -o /dev/null)
	if [[ ${responseCode} == 204 ]]
	then
		echo "Token successfully invalidated"
		bearerToken=""
		tokenExpirationEpoch="0"
	elif [[ ${responseCode} == 401 ]]
	then
		echo "Token already invalid"
	else
		echo "An unknown error occurred invalidating the token"
	fi
}

# Get Bearer Token
getBearerToken

# Azure IDP display name located in Jamf Pro Cloud Identity Providers Settings.
idpname="Display Name of the IDP in Jamf"

# Get Cloud IDP ID
cloudidpid=$(curl -X GET "https://${BASEURL}/api/v1/cloud-idp?page=0&page-size=100&sort=id%3Adesc" \
-H  "accept: application/json" \
-H  "Authorization: Bearer ${bearerToken}")
azureidp=$(echo $cloudidpid | grep -E "id|$idpname" | grep -v "providerName" )
idpid=$(echo $azureidp | grep -m 1 "id" | cut -d '"' -f4 )


# Loop to check membership; break if any are found true
membership=""
for i in "${Variable_LIST[@]}"; do
	for aduser in "${EMAIL_ADDRESSES[@]}"; do
		if [[ "$aduser" =~ "^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$" ]]; then
			adgroup="${i}"
			echo "\nChecking ${adgroup} with ${aduser}"
			membership+="${adgroup}="
			membership+=$(curl -X POST "https://${BASEURL}/api/v1/cloud-idp/${idpid}/test-user-membership" -H  "accept: application/json" -H  "Authorization: Bearer ${bearerToken}" -H  "Content-Type: application/json" -d "{\"username\":\"${aduser}\",\"groupname\":\"${adgroup}\"}" | grep "isMember" | awk '{ print $3 }' )
			membership+="\n"
			if [[ $membership == *"true"* ]]; then
				break
			fi
		fi
	done
	if [[ $membership == *"true"* ]]; then
		break
	fi
done

# Close token
invalidateToken

echo "\nRESULTS:\n$membership"

# Tag for Extension Attribute
if [[ $membership == *"true"* ]]; then
	echo "<result>TRUE</result>"
else
	echo "<result>FALSE</result>"
fi

Not sure you need the custom EA for this anymore.  It got added into Jamf’s built in stuff a few versions back.  In our environment, we’re just using Directory Service Attribute Mapping of memberOf.displayName to list out all the assigned user’s groups in Azure.

​@McAwesome 
 Awesome. Will you direct me to more details of setting this up?

​@McAwesome  Nm. I found it.

Create an Extension Attribute in Jamf Pro:

• In Jamf Pro, navigate to Settings > Computer Management > Extension Attributes.
• Click New.
• Configure the extension attribute with the following:
  • Display Name: Provide a descriptive name (e.g., "Azure AD Group Membership").
  • Data Type: Set this to String or Text as it will store group display names.
  • Input Type: Choose Directory Service Attribute Mapping.
  • LDAP Attribute: Enter memberOf.displayName. This tells Jamf to retrieve the display names of the groups the user is a member of from Entra ID.
  • Allow multiple

​​​

The documentation (Jamf’s and Microsoft’s) and the AI assistant are ALL wrong (or incomplete).  You guys are right, memberOf is just an object id or something and not the name, the name requires the displayName property.  This may have just made Jamf Pro usable by itself.  Much thanks!