Create or update a dynamic membership group in Microsoft Entra ID

You can use rules to determine dynamic membership groups based on user or device properties in Microsoft Entra ID. This article describes how to set up a rule for a dynamic membership groups in the Azure portal.

Group membership based on user or device properties is supported for security groups and Microsoft 365 groups. When you apply a rule for a dynamic membership group, user and device attributes are evaluated for matches with the membership rule. When an attribute changes for a user or device, all rules for dynamic membership groups in the organization are processed for changes. Users and devices are added or removed if they meet the conditions for a dynamic membership group. In Microsoft Entra ID, a single tenant can have a maximum of 15,000 dynamic membership groups.

Using dynamic membership groups requires a Microsoft Entra ID P1 license or an Intune for Education license. For more information, see Manage rules for dynamic membership groups in Microsoft Entra ID.

Microsoft Entra ID provides a rule builder to create and update your important rules more quickly. The rule builder supports the construction of up to five expressions.

The rule builder makes it easier to form a rule with a few simple expressions. However, it can't be used to reproduce every rule. If the rule builder doesn't support the rule that you want to create, you can use the text box.

Here are some examples of advanced rules or syntax for which we recommend that you use the text box:

• Rule with more than five expressions
• Rule for direct reports
• Setting operator precedence
• Rule with complex expressions; for example, (user.proxyAddresses -any (_ -contains "contoso"))

For examples of syntax and supported properties, operators, and values for a membership rule, see Manage rules for dynamic membership groups in Microsoft Entra ID.

1. Sign in to the Microsoft Entra admin center as at least a Groups Administrator.

2. Select Microsoft Entra ID > Groups.

3. Select All groups, and then select New group.

   

4. On the Group pane, enter a name and description for the new group. Select a Membership type value for either users or devices, and then select Add dynamic query.

5. In the rule builder, add up to five expressions. To add more than five expressions, you must use the text box.

   

6. To see the custom extension properties that are available for your membership query:

   1. Select Get custom extension properties.
   2. Enter the application ID, and then select Refresh properties.

7. After you finish creating the rule, select Save.

8. On the New group page, select Create to create the group.

If the rule that you entered isn't valid, the portal displays an explanation of why the rule couldn't be processed. Read it carefully to understand how to fix the rule.

1. Sign in to the Microsoft Entra admin center as at least a Groups Administrator.

2. Select Microsoft Entra ID.

3. Select Groups > All groups.

4. Select a group to open its profile.

5. On the profile page for the group, select Dynamic membership rules. The rule builder supports up to five expressions. To add more than five expressions, you must use the text box.

   

6. To see the custom extension properties that are available for your membership rule:

   1. Select Get custom extension properties.
   2. Enter the application ID, and then select Refresh properties.

7. After you finish updating the rule, select Save.

When an admin creates a new Microsoft 365 group, the users who are added to the group receive a welcome email notification. Later, if any attributes of a user or device (only for security groups) change, all rules for dynamic membership groups in the organization are processed for changes. Users who are added then also receive the welcome notification.

You can turn on or turn off this behavior in Exchange PowerShell.

You can see the rule processing status and the date of the last membership change on the overview page for the dynamic membership group.

The following status messages can appear for Dynamic rule processing status:

• Evaluating: The group change was received and the updates are being evaluated.
• Processing: Updates are being processed.
• Update complete: Processing finished and all applicable updates were made.
• Processing error: Processing couldn't finish because of an error in evaluating the membership rule.
• Update paused: The administrator paused the rule to update dynamic membership groups. MembershipRuleProcessingState is set to Paused.
• Not started: Processing hasn't started.

The following status messages appear for Last membership change:

• <Date and time>: The membership was last updated at this date and time.
• In Progress: Updates are currently in progress.
• Unknown: The last update time can't be retrieved. The group might be new.

If an error occurs during processing of the membership rule for a specific group, an alert appears on the top of the overview page for the group. If no pending updates for dynamic membership groups can be processed for all the groups within the organization for more than 24 hours, an alert appears above All groups.

• Create a group with members and view all groups and members
• Manage Microsoft Entra groups and group membership
• Manage rules for dynamic membership groups in Microsoft Entra ID