Automatic group membership saves IT administrators hours of manual onboarding and offboarding. Microsoft 365 offers dynamic groups to automatically update memberships based on user attributes like department, location, or job title. However, native Microsoft tools split this functionality across different portals and use conflicting query languages, creating significant administrative friction.
Why are Dynamic Groups in Microsoft 365
Dynamic groups use rules to determine membership automatically. Instead of manually adding users or devices, administrators define conditions that Microsoft Entra ID evaluates continuously in the background. Whenever a user’s attributes change, Microsoft automatically recalculates membership and updates the group accordingly. Microsoft supports two major dynamic group types:
| Group Type | Purpose |
|---|---|
| Dynamic Security Groups | Used for access control, application assignments, device targeting, and policy enforcement. |
| Dynamic Microsoft 365 Groups | Used for collaboration workloads such as Teams, Outlook, SharePoint, and Planner. |
Dynamic membership can be based on attributes such as department, country or city, employee type, job title, user type, device model, operating system, group membership, and custom directory attributes.
Native Hurdles in Creating Dynamic Groups in Microsoft 365
Managing dynamic groups through native Microsoft portals exposes several operational pain points.
- Split Admin Portals: Dynamic security groups live in the Microsoft Entra ID admin center. Dynamic distribution lists (for email) live in the Exchange admin center (EAC).
- Conflicting Syntax: Entra ID uses rule syntax like (user.department -eq “Sales”). Exchange Online requires OPATH filtering syntax like Value -eq ‘Sales’. Admins must master two entirely different query systems.
- No Native Previewing: Testing rules before deployment is notoriously difficult in native tools, often resulting in accidental mass-emails or missing members.
- Licensing Costs: Entra ID dynamic membership requires expensive Microsoft Entra ID P1 or P2 licenses for every user targeted by the rule.
How to Create Dynamic Microsoft 365 or Security Group in Entra Admin Center
Managing Microsoft 365 groups can quickly become frustrating because Microsoft spreads functionality across multiple admin portals. Dynamic membership rules are configured in the Microsoft Entra admin center, while several Microsoft 365 group settings are only available in the Microsoft 365 Admin Center. Some advanced group options, such as forwarding settings and automatic replies for Microsoft 365 groups, are not available in any portal at all and require PowerShell.
Here are the step-by-step user interface directions to create dynamic groups in Microsoft Entra admin center.
1. Sign in to the Microsoft Entra admin center as at least a Group administrator.
2. Navigate to Entra ID > Groups > All groups and select New group.
3. Select Group type as Security or Microsoft 365. Security groups can hold users or devices, but Microsoft 365 groups only support users.
4. Enter a Group name and description.
5. Change the Membership type dropdown to Dynamic User or Dynamic Device.
6. Click Add dynamic query.
7. Click Save on the query page, and then click Create to deploy the group.
Defining Rule Syntax
You can use the built-in rule builder for basic criteria or click Edit above the rule box to write advanced logic:
| Target Logic | Rule Syntax Example |
|---|---|
| All Users in Sales | (user.department -eq “Sales”) |
| All Employees (No Guests) | (user.objectId -ne null) -and (user.userType -eq “Member”) |
| Specific City OR State | (user.city -eq “New York”) -or (user.state -eq “NY”) |
| Target Cloud PCs (Devices) | (device.deviceModel -startsWith “CloudPC”) |
| Nested Group Membership | user.memberof -any (group.objectId -in [‘<your-group-object-id>’]) |
How to Manage & Troubleshoot Dynamic Groups
Following are the ways to troubleshoot dynamic groups in Microsoft 365.
- Validate Rules: Before deploying syntax changes, go to the Dynamic membership rules tab of your group, select Validate Rules, and add test users to verify if they will properly trigger inclusion.
- Monitor Changes: Check the Overview page of the group to see the Membership processing status. Initial evaluation or large updates can take up to 24 hours depending on tenant size.
- Pause Processing: If you need to perform bulk updates to user profiles without triggering constant re-evaluations, use the Pause processing button inside the group’s dynamic rules page.
- Teams & Resource Access: When connected to Microsoft Teams, owners cannot manually add or remove members because the Entra ID rule controls the list natively. Updates sync downstream to Teams within 2 hours.
Create and Manage Dynamic Groups with PowerShell
PowerShell provides a faster and more flexible way to create and manage dynamic groups without relying on graphical interfaces. To work with dynamic groups, use the modern Microsoft Graph PowerShell module, since the older AzureAD modules are now deprecated.
Before creating dynamic groups, install the required Microsoft Graph module and connect to your tenant with the necessary permissions:
# Install the Microsoft Graph Groups module
Install-Module Microsoft.Graph.Groups -Scope CurrentUser
# Connect to Microsoft Graph with required permissions
Connect-MgGraph -Scopes "Group.ReadWrite.All", "Directory.ReadWrite.All"
Create a Dynamic Security Group
Firstly, define the membership rule by storing the dynamic membership rule in a variable.
$GroupRule = '(user.department -eq "Sales")'Then, run the following command to create the dynamic security group.
New-MgGroup -DisplayName "Sales Dynamic Security" `
-MailNickname "salesdynamicsec" `
-MailEnabled:$false `
-SecurityEnabled:$true `
-GroupTypes "DynamicMembership" `
-MembershipRule $GroupRule `
-MembershipRuleProcessingState "On"Create a Dynamic Microsoft 365 Group
Here also we can specify the rule that determines group membership:
$M365Rule = '(user.department -eq "Sales") -and (user.userType -eq "Member")'Then, include “Unified” in the GroupTypes parameter to create a Microsoft 365 group with dynamic membership:
New-MgGroup -DisplayName "Sales Dynamic M365" `
-MailNickname "salesdynamicm365" `
-MailEnabled:$true `
-SecurityEnabled:$true `
-GroupTypes "Unified", "DynamicMembership" `
-MembershipRule $M365Rule `
-MembershipRuleProcessingState "On"Centralize Dynamic Group Administration Using EasyEntra
EasyEntra provides a simpler interface for creating and managing Dynamic Groups in Microsoft 365 environments. Instead of navigating through multiple Microsoft admin portals, administrators can configure dynamic membership settings directly from the EasyEntra interface.
1. Open Groups in Entra ID. Right click on Groups.
2. Click on New Group.
3. Select the required Group type from the drop down.
4. Enter Display name or Description for the required group type.
5. Change the Membership type to Dynamic.
6. And then enter the required Membership rule.
7. Click Next and Create.
A more centralized approach also helps reduce dependency on PowerShell for routine operations and improves visibility into group configurations!
