title: Azure AD nested groups and role assignment in Enterprise Application
body: <p>I have an enterprise application in Azure with some roles defined, let's say:</p>
  
  <ul>
  <li>professor role </li>
  <li>student role </li>
  <li>staff role</li>
  </ul>
  
  <p>Then I have some Active Directory groups which are nested, like:  </p>
  
  <ul>
  <li>root professor group PROF
  
  <ul>
  <li>nested professor group PROF1</li>
  <li>nested professor group PROF2</li>
  <li>and many more similar, even more nested...</li>
  </ul></li>
  <li>root student group STUD
  
  <ul>
  <li>nested student group STUD1</li>
  <li>nested student group STUD2</li>
  <li>and many more similar, even more nested...</li>
  </ul></li>
  <li>root staff group STAFF
  
  <ul>
  <li>nested student group STAFF1</li>
  <li>nested student group STAFF2</li>
  <li>and many more similar, even more nested...</li>
  </ul></li>
  </ul>
  
  <p>I can assign users and AD groups to those roles. However, when I want to assign a group to a role, it works only when a user is a direct member of the group. If, for instance, I add the whole group STUD to a role, it does not work with role assignment. Therefore I have to add all the single nested roles to the role, which is quite time consuming. 
  But that would have been acceptable as one-time-solution. Bad thing is, there are new groups and users constantly. And I'd have to keep the role assignments up-to-date manually all the time.</p>
  
  <p>Ideally I'd like to say: everyone from the STUD root AD group gets the <em>student</em> role etc. Apparently this is not possible:
  <a href="https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/15718164-add-support-for-nested-groups-in-azure-ad-app-acc" rel="nofollow noreferrer">https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/15718164-add-support-for-nested-groups-in-azure-ad-app-acc</a></p>
  
  <p>Is it maybe possible to do it via some automated script? Maybe you have some other ideas? 
  Thanks in advance!</p>