Create or update a dynamic membership group in Microsoft Entra ID

A dynamic membership group in Microsoft Entra ID (formerly Azure Active Directory) adds and removes members automatically, based on rules that match user or device properties. When an attribute changes, Entra evaluates your dynamic group rules and updates membership. You can’t add or remove members of a dynamic group by hand.

Before you start

• Role: Groups Administrator or higher to create or edit rules.
• Licence: every unique user who is a member of one or more dynamic groups needs a Microsoft Entra ID P1 or Intune for Education licence. Device-only dynamic groups need no licence.
• Group types: security groups can contain users or devices. Microsoft 365 groups (formerly Office 365 groups) can contain users only. You can’t mix users and devices in one rule.
• Limits: up to 15,000 dynamic groups per tenant, and a rule body of up to 3,072 characters.
• Not allowed: role-assignable groups can’t use dynamic membership.

Create a dynamic group

1. Sign in to the Microsoft Entra admin center as at least a Groups Administrator.
2. Go to Microsoft Entra ID > Groups > All groups, then select New group.
3. Enter a group name and description. Choose a Membership type for users or devices, then select Add dynamic query.
4. Build the rule. The rule builder supports up to five expressions. For more, use the text box (see below).
5. To use custom extension properties, select Get custom extension properties, enter the application ID and select Refresh properties.
6. Select Save, then select Create on the New group page.

If the rule is invalid, the portal explains why it couldn’t be processed. There is no separate Validate button, so read the message and fix the rule.

Update an existing rule

1. Go to Microsoft Entra ID > Groups > All groups and select the group.
2. Select Dynamic membership rules.
3. Edit the rule, refresh custom extension properties if needed, and select Save.

Rule builder or text box?

The rule builder is quick for simple user rules. It is available only for user-based groups and doesn’t change rule syntax, validation or processing. Use the text box for:

• Device rules
• More than five expressions
• Direct reports rules
• Operator precedence and complex expressions
• -contains and -notContains

Rule syntax cheat sheet

A single expression has the form <object>.<property> <operator> <value>. Property names are case sensitive. Regular expressions and string comparisons are not.

Example rules

user.department -eq "Sales"

(user.department -eq "Sales") -or (user.department -eq "Marketing")

(user.country -eq "US") -and (user.department -in ["50001","50002","51100"])

(user.objectId -ne null) -and (user.userType -eq "Member")

(user.proxyAddresses -any (_ -startsWith "contoso"))

device.deviceTrustType -eq "AzureAD"

Direct Reports for "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb"

Operators

-eq, -ne, -startsWith, -notStartsWith, -endsWith, -notEndsWith, -contains, -notContains, -match, -notMatch, -in, -notIn, -le, -ge, plus -and, -or and -not. Precedence, highest first: comparison operators, -not, -and, -or, then -any and -all. Use parentheses to control the order.

Common properties

Type	Examples
User (string)	department, city, country, companyName, jobTitle, mail, userPrincipalName, usageLocation, userType, employeeId, objectId
User (other)	accountEnabled, dirSyncEnabled (boolean), proxyAddresses and assignedPlans (collections), extensionAttribute1 to 15
Custom extension	user.extension_[GUID]_[Attribute]
Device	deviceOwnership, deviceTrustType, deviceOSType, deviceOSVersion, deviceManufacturer, deviceModel, deviceCategory, managementType, isRooted

Some properties, such as employeeHireDate and memberOf, are in preview. Check the full property list before relying on one.

Common mistakes

• Checking for null: use user.mail -ne null. Don’t use -not as a null comparison.
• Quotes: escape a double quote inside a string with a backtick (`), and a single quote with two single quotes.
• Mixing users and devices: one rule can’t reference both. Device rules can use only device attributes, not the owner’s user attributes.
• Direct reports rules: they can’t be combined with other rules, and the manager is also added to the group.
• Slow rules: avoid -match and -contains. Prefer -eq, -startsWith or -endsWith. Combine several -or values with -in, and several -and exclusions with -notIn. See Create simpler, more efficient rules.

Create or update a dynamic group with Microsoft Graph

To create a dynamic security group, send a POST to /groups with DynamicMembership in groupTypes. The app needs the Group.Create application permission, or Group.ReadWrite.All as a delegated permission.

POST https://graph.microsoft.com/v1.0/groups
Content-Type: application/json

{
  "displayName": "Sales dynamic group",
  "mailEnabled": false,
  "mailNickname": "salesdynamic",
  "securityEnabled": true,
  "groupTypes": [ "DynamicMembership" ],
  "membershipRule": "(user.department -eq \"Sales\")",
  "membershipRuleProcessingState": "On"
}

To change the rule on an existing group, send a PATCH to /groups/{group-id} with the new membershipRule. Confirm the permissions on the Update group reference first. Setting membershipRuleProcessingState to Paused pauses processing, and On resumes it.

Check processing status

Open the group’s Overview page to see Membership processing and Membership last updated. Microsoft doesn’t publish a fixed processing time.

• Evaluating: the change was received and is being evaluated.
• Processing: updates are being applied.
• Update complete: all applicable updates are done.
• Processing error: the rule couldn’t be evaluated, and an alert appears at the top of the group’s Overview page.
• Update paused: an administrator paused rule updates (MembershipRuleProcessingState is Paused).

If no pending dynamic membership updates can be processed for more than 24 hours, an alert appears above All groups. Rules evaluate every user and device in the tenant, including stale ones, so clean up old objects first to avoid inflated membership and slower processing.

Security: check who can write the attribute

Before you use an attribute in a rule, check who can write to it, both in Entra ID and in the source directory such as on-premises Active Directory. If users can edit an attribute on themselves, they may be able to add themselves to a group. Don’t grant access to anything sensitive through a group whose rule uses a user-writable attribute.

Turn the welcome email on or off

When a Microsoft 365 group is created, a welcome email goes to the users added to it, and users added later by a dynamic rule receive it too. Turn this off with Exchange Online PowerShell. See Set-UnifiedGroup for the current syntax.

Sources

• Create or update a dynamic membership group (Microsoft Learn)
• Dynamic membership rules for groups in Microsoft Entra ID (Microsoft Learn)
• Create simpler, more efficient rules (Microsoft Learn)
• Create group (Microsoft Graph)

Last reviewed: October 23, 2026.