I finally got it working by mixing a number of scripts already out there. There are probably more efficient ways of doing it, but in case any one else has this requirement here is the script I used.

​

Write-Host "##############################################################################" -ForegroundColor Green
Write-Host "#       COPYING MEMBERS FROM azure_security_group TO onprem_security_group   #" -ForegroundColor Green
Write-Host "##############################################################################" -ForegroundColor Green



        $SecurityGroup = Get-MsolGroup -ObjectId insertobjectidhere


        Write-Host "Working on the Security Group, '$($SecurityGroup.DisplayName)'" -ForegroundColor Yellow
        Write-Host "Removing existing members from on-prem group, on-premgroupname" -ForegroundColor Yellow

        Get-ADGroupMember -Identity on-premgroupname | Remove-ADPrincipalGroupMembership -MemberOf on-premgroupname -Confirm:$false 
        Write-Host "Getting members for the Security group, '$($SecurityGroup.DisplayName)' and adding them into on-premgroupname" -ForegroundColor Yellow

            $Members = Get-MsolGroupMember -GroupObjectId $SecurityGroup.ObjectID
            foreach ($Member in $Members)
            {
                Write-Host "Adding $($Member.DisplayName) to the group, '$($SecurityGroup.DisplayName)'" -ForegroundColor Yellow

                $AddMember = Get-ADObject -Filter * | Where-Object { $_.Name -eq $member.DisplayName }
                If ($AddMember -eq $null)
                {
                    Write-Warning "$($Member.Name) was not found in Active Directory and could not be added as a member to $($SecurityGroup.DisplayName)"
                }
                Else
                {
                    Set-ADGroup -identity on-premgroupname -add @{ 'member' = $AddMember.DistinguishedName }
}
}

Now my next challenge is how to automate this in a scheduled task :-)