A number of people have seen success with the OpenID Connect plugin. There is a short section about Azure AD at the bottom of the first post here:
By default, people will click “Login” in Discourse, be directed to Azure. When they return to Discourse they will be shown the signup form (which is the same as the regular signup form, minus the password field). There are various site settings you can use to control the signup behaviour.
Group synchronisation isn’t supported at the moment. You might be able to achieve something by building an integration with the Discourse API.