Configure dynamic membership with the memberOf operator

This page's changes and edits · All guidance changes

Microsoft's edit · 27 Mar 2025 15:39 UTC

Merge branch 'main' into patch-4

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 926aaae · +9 −7 lines · also on GitHub

11 ---

2 −title: Group membership for Microsoft Entra dynamic groups with memberOf

2 +title: Configure dynamic membership groups with the memberOf attribute in the Azure portal

33 description: Learn how to create a dynamic membership group that can contain members of other groups in Microsoft Entra ID.

55 author: billmath

6 −manager: amycolannino

6 +manager: femila

77 ms.service: entra-id

88 ms.subservice: users

99 ms.topic: conceptual

10 −ms.date: 04/30/2024

10 +ms.date: 12/30/2024

1111 ms.author: billmath

1212 ms.reviewer: krbain

1313 ms.custom: it-pro

1414 ---

1515

16 −# Group membership in a dynamic group in Microsoft Entra ID

16 +# Configure dynamic membership groups with the memberOf attribute in the Azure portal

1717

18 −This feature preview in Microsoft Entra ID enables admins to create dynamic groups and administrative units that populate by adding members of other groups using the `memberOf` attribute. Apps that couldn't read group-based membership previously in Microsoft Entra ID can now read the entire membership of these new `memberOf` groups. Not only can these groups be used for apps but they can also be used for licensing assignments.

18 +This feature preview in Microsoft Entra ID enables admins to create dynamic membership groups and administrative units that populate by adding members of other groups using the `memberOf` attribute. Apps that couldn't read group-based membership previously in Microsoft Entra ID can now read the entire membership of these new `memberOf` groups. Not only can these groups be used for apps but they can also be used for licensing assignments.

1919

2020 The following diagram illustrates how you could create Dynamic-Group-A with members of Security-Group-X and Security-Group-Y. Members of the groups inside Security-Group-X and Security-Group-Y don't become members of Dynamic-Group-A.

2121

2222 :::image type="content" source="./media/groups-dynamic-rule-member-of/member-of-diagram.png" alt-text="Diagram that shows how the memberOf attribute works.":::

2323

24 −With this preview, admins can configure dynamic groups with the `memberOf` attribute in the Azure portal, Microsoft Graph, and PowerShell. Security groups, Microsoft 365 groups, and groups that are synced from on-premises Active Directory can all be added as members of these dynamic groups. They can also all be added to a single group. For example, the dynamic group could be a security group, but you can use Microsoft 365 groups, security groups, and groups that are synced from on-premises to define its membership.

24 +With this preview, admins can configure dynamic membership groups with the `memberOf` attribute in the Azure portal, Microsoft Graph, and PowerShell. Security groups, Microsoft 365 groups, and groups that are synced from on-premises Active Directory can all be added as members of these dynamic membership groups. They can also all be added to a single group. For example, the dynamic group could be a security group, but you can use Microsoft 365 groups, security groups, and groups that are synced from on-premises to define its membership.

2525

2626 ## Prerequisites

2727

⋯ 1 unchanged line

2929

3030 ## Preview limitations

3131

32 +

3233 - Each Microsoft Entra tenant is limited to 500 dynamic groups using the `memberOf` attribute. The `memberOf` groups count toward the total dynamic group quota of 15,000.

3334 - Each dynamic group can have up to 50 member groups.

34 −- When you add members of security groups to `memberOf` dynamic groups, only direct members of the security group become members of the dynamic group.

35 +- When you add members of security groups to `memberOf` dynamic membership groups, only direct members of the security group become members of the dynamic group.

3536 - You can't use one `memberOf` dynamic group to define the membership of another `memberOf` dynamic group. For example, Dynamic Group A, with members of group B and C in it, can't be a member of Dynamic Group D.

3637 - The `memberOf` attribute can't be used with other rules. For example, a rule that states dynamic group A should contain members of group B and also should contain only users located in Redmond will fail.

3738 - The dynamic group rule builder and validate feature can't be used for `memberOf` at this time.

3839 - The `memberOf` attribute can't be used with other operators. For example, you can't create a rule that states "Members Of group A can't be in Dynamic group B."

40 +- Users included in `memberOf` dynamic membership groups may cause a slower processing time for your tenant, if the tenant has a large number of groups or frequent dynamic membership groups updates.

3941

4042 ## Get started

4143

⋯ 14 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.