Topic starter
06/06/2026 11:24 am
TL;DR: Azure Entra ID does not expand nested group membership over SCIM, so users inside child groups can disappear from app provisioning and login paths unless teams flatten membership, assign child groups directly, or reconcile through Microsoft Graph, according to WorkOS. The real issue is that authorization models often assume hierarchy will survive sync, but SCIM only carries what Entra explicitly sends.
Editorial analysis by NHI Mgmt Group, based on content published by WorkOS: “Azure Entra nested groups and Directory Sync: Limitations and workarounds”.
Key questions
Q: What breaks when Azure Entra nested groups are synced through SCIM?
A: Inherited memberships do not survive the SCIM boundary, so users inside child groups may not be provisioned into the target application.
Q: Why do nested groups create access problems in Entra Directory Sync?
A: Because the provisioning model assumes the receiving app can act on a flat membership set, while the source directory may be expressing access through inherited relationships.
Q: How should teams handle nested groups when SCIM cannot expand them?
A: Either flatten the membership for the app, assign each child group directly, or use a separate reconciliation process that computes transitive members from Microsoft Graph.
Practitioner guidance
- Test nested-group provisioning explicitly Include child-group scenarios in every Directory Sync validation so you can confirm what Entra sends and what the application actually receives.
- Flatten app-scoped group membership Create dedicated direct-membership groups for app provisioning when the application cannot safely interpret inherited group structure.
- Assign child groups directly where scale demands it Map each relevant child group to the enterprise application when the tenant structure is already organised by region, business unit, or team.
Bottom line: Azure Entra nested groups can disappear from downstream entitlement logic when SCIM provisioning only transmits direct membership.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 12:11 pm
SCIM inheritance breaks at the connector boundary: Entra nested groups are a directory convenience, not a provisioning guarantee. The application only receives what Entra explicitly sends, so hierarchical access disappears the moment the sync payload is flattened. That means downstream entitlement logic must be designed for direct membership only, not assumed inheritance.
A question worth separating out:
Q: What should identity teams check first when users are missing after Entra sync?
A: Start with the group assignment in the enterprise app, then verify whether the assigned group contains child groups, and finally inspect the provisioning logs for skipped descendants. If the logs show only direct members, the problem is usually nested membership rather than a login issue. That sequence separates connector scope from downstream access errors.
👉 Read our full editorial: Azure Entra nested groups break SCIM provisioning expectations