Manually adding people to groups works until it doesn’t. Someone forgets to add the new sales hire to the license group, or nobody removes the contractor from the finance share. Entra dynamic groups fix this by calculating membership from user or device attributes. Set the rule once, and Entra adds and removes members as attributes change. Point licensing, Intune policies and app access at those groups, and a lot of daily admin disappears.
How dynamic membership works
A dynamic membership group has a rule instead of a member list. Whenever a user’s or device’s attributes change, Microsoft Entra ID evaluates the rules and updates membership. If a user’s department changes from “Finance” to “Sales”, they drop out of the finance group and join the sales group without anyone touching either.
Some ground rules:
A rule targets either users or devices, not both in the same group.
Device rules can only reference device attributes, not attributes of the device’s owner.
You cannot manually add or remove members of a dynamic group.
Dynamic rules work for security groups and Microsoft 365 groups. Microsoft 365 groups can only contain users.
Role-assignable groups cannot be dynamic, which is deliberate.
Licensing
Dynamic membership requires a Microsoft Entra ID P1 license for each unique user who is a member of one or more dynamic groups. You do not have to assign the license to those users, but you need enough P1 licenses in the tenant to cover them. Device members do not need a license. Microsoft 365 Business Premium, E3 and E5 all include Entra ID P1, so most businesses on those plans are already covered.
Rules that cover most small and mid-sized businesses
Create a group from Entra ID > Groups > New group, set the membership type to Dynamic User or Dynamic Device, and add a dynamic query. The rule builder handles simple expressions. For anything with more than five expressions, or operators like -contains, use the text editor.
Use the Validate rules option before saving. It lets you test specific users or devices against the rule and see whether they would be included.
Driving licensing from dynamic groups
Group-based licensing assigns licenses to everyone in a group. Combine it with a dynamic group, and new employees get their licenses as soon as their account exists with the right attributes. Leavers lose them when their account is disabled.
Create a dynamic user group, for example LIC-M365-BusinessPremium, with a rule like “enabled members in department X” or “enabled members with a company name of Y”.
Go to Billing > Licenses > All products, select the license, and assign it to the group.
Disable any service plans you do not want, such as a specific app, in the same assignment.
Watch the group’s licenses page for assignment errors, such as running out of available licenses.
One caution I see trip people up: building a dynamic group based on which licenses users already have, then assigning an add-on license to that group. Membership and license processing run separately, and dependency errors are common. Base license groups on organizational attributes like department or company, not on license state.
Driving Intune and Conditional Access from dynamic groups
Dynamic device groups are the backbone of a clean Intune setup. Target compliance policies, configuration profiles and app deployments at groups like “All corporate Windows devices” or “All Autopilot devices”, and every new device picks up the right settings at enrollment. Dynamic user groups work well for Conditional Access scoping, for example “all members excluding guests”.
The security risk most people miss
A dynamic group is only as trustworthy as the attributes in its rule. If a group grants access to finance data based on user.department, then anyone who can change the department attribute can grant themselves access. That includes on-premises Active Directory, where some attributes may be writable by the users themselves.
Before you use an attribute in a rule that controls access, check who can write it, both in Entra ID and in any source directory. For sensitive access, use attributes controlled by HR or IT only, or stick with assigned membership.
Operational tips
Expect some delay. Membership changes are not instant, especially in larger tenants or after a rule edit. Teams can take longer again to reflect changes in a team’s membership.
Watch processing status. Each dynamic group shows its processing status and last update time. Paused or failed processing is your first clue when someone is missing access.
Clean up attributes first. Inconsistent values, such as “Sales”, “sales ” and “Sales Dept”, break rules quietly. Standardize at the source.
Avoid preview operators in production. The memberOf operator preview, which built groups from other groups’ members, ended on November 3, 2026. Groups that used it stop updating and stay in their last state, so review and replace any rules that relied on it.
Name groups by purpose. A prefix like LIC-, INT-, CA- or APP- shows at a glance what a group drives.
A starter set for a 50 to 300 person business
If you are starting from scratch, a small set of dynamic groups covers most needs. One group of all enabled employees, excluding guests, for baseline licensing and Conditional Access. One group per department for department apps and SharePoint sites. One group per office if locations matter for printers or local policies. On the device side, one group each for corporate Windows, macOS, iOS and Android devices, plus an Autopilot group. That is roughly a dozen groups, and together they remove most of the manual membership work a typical IT team does every week. Add more only when a real requirement appears.
Can I convert an existing assigned group to dynamic?
Yes. You can change a group’s membership type from assigned to dynamic. When you do, existing members who do not match the rule are removed, so validate the rule first and check what the group currently grants.
How quickly do dynamic groups update?
Usually within minutes for individual changes, but it can take longer in large tenants or after a rule change that forces re-evaluation of every user. Microsoft does not guarantee a fixed time, so do not rely on dynamic groups for time-critical access removal.
Can one dynamic group contain both users and devices?
No. A dynamic membership rule targets either users or devices. If a policy needs both, create two groups, one dynamic user group and one dynamic device group, and assign the policy to each.
Spending too much time adding people to groups by hand? Book a free Microsoft 365 security assessment and we will review your groups, licensing and policy targeting.
Manually adding people to groups works until it doesn’t. Someone forgets to add the new sales hire to the license group, or nobody removes the contractor from the finance share. Entra dynamic groups fix this by calculating membership from user or device attributes. Set the rule once, and Entra adds and removes members as attributes change. Point licensing, Intune policies and app access at those groups, and a lot of daily admin disappears.
How dynamic membership works
A dynamic membership group has a rule instead of a member list. Whenever a user’s or device’s attributes change, Microsoft Entra ID evaluates the rules and updates membership. If a user’s department changes from “Finance” to “Sales”, they drop out of the finance group and join the sales group without anyone touching either.
Some ground rules:
Licensing
Dynamic membership requires a Microsoft Entra ID P1 license for each unique user who is a member of one or more dynamic groups. You do not have to assign the license to those users, but you need enough P1 licenses in the tenant to cover them. Device members do not need a license. Microsoft 365 Business Premium, E3 and E5 all include Entra ID P1, so most businesses on those plans are already covered.
Rules that cover most small and mid-sized businesses
Create a group from
Entra ID > Groups > New group, set the membership type to Dynamic User or Dynamic Device, and add a dynamic query. The rule builder handles simple expressions. For anything with more than five expressions, or operators like-contains, use the text editor.(user.accountEnabled -eq true) -and (user.userType -eq "Member")(user.department -eq "Sales")(user.physicalDeliveryOfficeName -eq "Chicago")(user.userType -eq "Guest") -and (user.mail -contains "@partner.com")(device.deviceOSType -eq "Windows") -and (device.deviceOwnership -eq "Company")(device.devicePhysicalIDs -any (_ -startsWith "[ZTDID]"))Use the Validate rules option before saving. It lets you test specific users or devices against the rule and see whether they would be included.
Driving licensing from dynamic groups
Group-based licensing assigns licenses to everyone in a group. Combine it with a dynamic group, and new employees get their licenses as soon as their account exists with the right attributes. Leavers lose them when their account is disabled.
Billing > Licenses > All products, select the license, and assign it to the group.One caution I see trip people up: building a dynamic group based on which licenses users already have, then assigning an add-on license to that group. Membership and license processing run separately, and dependency errors are common. Base license groups on organizational attributes like department or company, not on license state.
Driving Intune and Conditional Access from dynamic groups
Dynamic device groups are the backbone of a clean Intune setup. Target compliance policies, configuration profiles and app deployments at groups like “All corporate Windows devices” or “All Autopilot devices”, and every new device picks up the right settings at enrollment. Dynamic user groups work well for Conditional Access scoping, for example “all members excluding guests”.
The security risk most people miss
A dynamic group is only as trustworthy as the attributes in its rule. If a group grants access to finance data based on
user.department, then anyone who can change the department attribute can grant themselves access. That includes on-premises Active Directory, where some attributes may be writable by the users themselves.Before you use an attribute in a rule that controls access, check who can write it, both in Entra ID and in any source directory. For sensitive access, use attributes controlled by HR or IT only, or stick with assigned membership.
Operational tips
memberOfoperator preview, which built groups from other groups’ members, ended on November 3, 2026. Groups that used it stop updating and stay in their last state, so review and replace any rules that relied on it.A starter set for a 50 to 300 person business
If you are starting from scratch, a small set of dynamic groups covers most needs. One group of all enabled employees, excluding guests, for baseline licensing and Conditional Access. One group per department for department apps and SharePoint sites. One group per office if locations matter for printers or local policies. On the device side, one group each for corporate Windows, macOS, iOS and Android devices, plus an Autopilot group. That is roughly a dozen groups, and together they remove most of the manual membership work a typical IT team does every week. Add more only when a real requirement appears.
Microsoft’s reference for rule syntax and operators is Manage rules for dynamic membership groups in Microsoft Entra ID. If you are rebuilding your group structure as part of an Intune rollout, our Intune deployment service designs the device groups with you, and the Intune health check reviews existing group targeting. To estimate licensing across plans, try the Microsoft 365 cost calculator.
Frequently asked questions
Can I convert an existing assigned group to dynamic?
Yes. You can change a group’s membership type from assigned to dynamic. When you do, existing members who do not match the rule are removed, so validate the rule first and check what the group currently grants.
How quickly do dynamic groups update?
Usually within minutes for individual changes, but it can take longer in large tenants or after a rule change that forces re-evaluation of every user. Microsoft does not guarantee a fixed time, so do not rely on dynamic groups for time-critical access removal.
Can one dynamic group contain both users and devices?
No. A dynamic membership rule targets either users or devices. If a policy needs both, create two groups, one dynamic user group and one dynamic device group, and assign the policy to each.
Spending too much time adding people to groups by hand? Book a free Microsoft 365 security assessment and we will review your groups, licensing and policy targeting.