Configure dynamic membership with the memberOf operator
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 64310e7 · +9 −6 lines · also on GitHub
11
---
2
−title: Configure dynamic membership groups with the memberOf attribute in the Azure portal
2
+title: Configure dynamic membership groups with the memberOf attribute in the Azure portal (preview)
33
description: Learn how to create a dynamic membership group that can contain members of other groups in Microsoft Entra ID.
4
−
5
−author: billmath
6
−manager: femila
4
+author: barclayn
5
+manager: pmwongera
76
ms.service: entra-id
87
ms.subservice: users
98
ms.topic: how-to
10
−ms.date: 12/30/2024
11
−ms.author: billmath
9
+ms.date: 11/18/2025
10
+ms.author: barclayn
1211
ms.reviewer: krbain
1312
ms.custom: it-pro
1413
---
⋯ 2 unchanged lines
1716
1817
This feature preview in Microsoft Entra ID enables admins to create dynamic membership groups and administrative units that populate by adding members of other groups using the `memberOf` attribute. Apps that couldn't read group-based membership previously in Microsoft Entra ID can now read the entire membership of these new `memberOf` groups. Not only can these groups be used for apps but they can also be used for licensing assignments.
1918
19
+>[!WARNING]
20
+>This is a preview feature and is not intended for production use. The use of this feature comes with limitations that can impact dynamic group processing in the tenant. We recommend you review the [Preview limitations](#preview-limitations) section before using this feature.
21
+
2022
The following diagram illustrates how you could create Dynamic-Group-A with members of Security-Group-X and Security-Group-Y. Members of the groups inside Security-Group-X and Security-Group-Y don't become members of Dynamic-Group-A.
2123
2224
:::image type="content" source="./media/groups-dynamic-rule-member-of/member-of-diagram.png" alt-text="Diagram that shows how the memberOf attribute works.":::
⋯ 7 unchanged lines
3032
## Preview limitations
3133
3234
35
+- This preview should only be used in test environments as it can impact dynamic group processing in the tenant. We are working on addressing these limitations and will provide updates when they are available.
3336
- Each Microsoft Entra tenant is limited to 500 dynamic groups using the `memberOf` attribute. The `memberOf` groups count toward the total dynamic group quota of 15,000.
3437
- Each dynamic group can have up to 50 member groups.
3538
- When you add members of security groups to `memberOf` dynamic membership groups, only direct members of the security group become members of the dynamic group.
⋯ 22 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.