I've been deep in automating our onboarding flows, and one of the trickiest parts was always keeping Entra ID group memberships in sync with our HR system (we use BambooHR). Manually adding people to the right groups based on department, location, or role was a constant chore and source of errors.
I built a flow in Power Automate that handles this pretty elegantly. The core idea is:
* When a new hire is provisioned (or an employee's details change) in the HR system, it triggers the flow.
* The flow fetches the user's attributes (like `department`, `costCenter`, `extensionAttribute1` for custom roles).
* It then uses a mapping table (stored in a SharePoint list for easy management) to determine which Entra ID groups correspond to those attributes.
* Finally, it adds the user to the calculated groups and removes them from any old ones if attributes change.
The key was handling the group mapping logic cleanly. I avoid hardcoding group IDs. Instead, the SharePoint list acts as a config table where admins can update mappings without touching the flow logic. For example:
- `department = Engineering` -> groups: `entra-group-eng-all`, `entra-group-vscode-license`
- `costCenter = 1205 & location = UK` -> group: `entra-group-uk-marketing`
Has anyone else tackled this? I'm curious about a few points:
* How do you handle nested groups? I add users to parent groups directly, but I know some prefer nested group membership.
* What's your strategy for error handling when a user hasn't been fully provisioned in Entra yet? I've added retries with a delay.
* Did you consider using dynamic groups instead? I found the mapping table gave us more flexibility for complex rules.