Create simpler, more efficient dynamic membership rules

This page's changes and edits · All guidance changes

Microsoft's edit · 21 Apr 2025 23:02 UTC

edit pass: microsoft-entra-dynamic-groups

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 452110d · +25 ~~−20~~ lines · also on GitHub

11 ---

2 −title: Create simpler and faster rules for dynamic membership groups

3 −description: How to optimize your membership rules to automatically populate groups.

2 +title: Create Simpler and Faster Rules for Dynamic Membership Groups

3 +description: Learn how to optimize your membership rules to automatically populate groups.

55 author: barclayn

66 manager: femila

⋯ 9 unchanged lines

1616

1717 # Create simpler, more efficient rules for dynamic membership groups in Microsoft Entra ID

1818

19 −The Microsoft Entra ID engineering team, part of Microsoft Entra, receives reports of incidents related to dynamic membership groups and the processing time for their membership rules. The information that is reported is presented in this article. This article also discusses the most common methods by which Microsoft helps customers to simplify their rules for dynamic membership groups. Simpler and more efficient rules result in better dynamic group processing times.

19 +This article also discusses the most common methods that you can use to simplify your rules for dynamic membership groups. Rules that are simpler and more efficient result in better processing times for dynamic groups.

2020

21 −When writing membership rules for dynamic membership groups, follow the steps in this article to ensure that you create these rules as efficiently as possible.

21 +When you're writing membership rules for dynamic membership groups, follow the tips in this article to ensure that you create these rules as efficiently as possible.

2222

23 −## Minimize use of MATCH

23 +## Minimize use of the -match operator

2424

25 −Minimize the usage of the `match` operator in rules as much as possible. Instead, explore if it's possible to use the `startswith` or `-eq` operators. Considering using other properties that allow you to write rules to select the users you want to be in the group without using the `-match` operator. For example, if you want a rule for the group for all users whose city is Lagos, then instead of using rules like:

25 +Minimize your use of the `-match` operator in rules as much as possible. Instead, explore if it's possible to use the `-startswith` or `-eq` operator. Consider using other properties that allow you to write rules to select the users for a group without using the `-match` operator.

2626

27 +For example, if you want a rule for the group that contains all users whose city is Lagos, don't use a rule like this one:

28 +

2729 - `user.city -match "ago"`

2830 - `user.city -match ".*?ago.*"`

2931

30 −It's better to use rules like:

32 +It's better to use a rule like this example:

3133

32 −- `user.city -startswith "Lag"`

34 +- `user.city -startswith "Lag"`

3335

3436 Or, best of all:

3537

3638 - `user.city -eq "Lagos"`

3739

38 −## Minimize use of CONTAINS

40 +## Minimize use of the -contains operator

3941

40 −Similar to the use of MATCH. Minimize the usage of the `contains` operator in rules as much as possible. Instead, explore if it's possible to use the `startswith` or `-eq` operators. Utilizing CONTAINS can increase processing times, especially for tenants with many dynamic membership groups.

42 +As with `-match`, minimize your use of the `-contains` operator in rules as much as possible. Instead, explore if it's possible to use the `-startswith` or `-eq` operator. Using `-contains` can increase processing times, especially for tenants that have many dynamic membership groups.

4143

42 −## Use fewer OR operators

44 +## Use fewer -or operators

4345

44 −In your rule, identify when it uses various values for the same property linked together with `-or` operators. Instead, use the `-in` operator to group them into a single criterion to make the rule easier to evaluate. For example, instead of having a rule like this:

46 +Identify when your rule uses various values for the same property, linked together with `-or` operators. Instead, use the `-in` operator to group them into a single criterion. A single criterion makes the rule easier to evaluate.

4547

48 +For example, don't use a rule like this one:

49 +

4650 ```

4751 (user.department -eq "Accounts" -and user.city -eq "Lagos") -or

4852 (user.department -eq "Accounts" -and user.city -eq "Ibadan") -or

⋯ 2 unchanged lines

5155 (user.department -eq "Accounts" -and user.city -eq "Port Harcourt")

5256 ```

5357

54 −It's better to have a rule like this:

58 +It's better to use a rule like this example:

5559

5660 - `user.department -eq "Accounts" -and user.city -in ["Lagos", "Ibadan", "Kaduna", "Abuja", "Port Harcourt"]`

5761

58 −Conversely, identify similar sub criteria with the same property not equal to various values that are linked with `-and` operators. Then use the `-notin` operator to group them into a single criterion to make the rule easier to understand and evaluate. For example, instead of using a rule like this:

62 +Conversely, identify similar subcriteria with the same property not equal to various values that are linked with `-and` operators. Then use the `-notin` operator to group them into a single criterion to make the rule easier to understand and evaluate.

5963

64 +For example, don't use a rule like this one:

65 +

6066 - `(user.city -ne "Lagos") -and (user.city -ne "Ibadan") -and (user.city -ne "Kaduna") -and (user.city -ne "Abuja") -and (user.city -ne "Port Harcourt")`

6167

62 −It's better to use a rule like this:

68 +It's better to use a rule like this example:

6369

6470 - `user.city -notin ["Lagos", "Ibadan", "Kaduna", "Abuja", "Port Harcourt"]`

6571

6672 ## Avoid redundant criteria

6773

68 −Ensure that you aren't using redundant criteria in your rule. For example, instead of using a rule like this:

74 +Ensure that you aren't using redundant criteria in your rule. For example, instead of using a rule like this one:

6975

7076 - `user.city -eq "Lagos" or user.city -startswith "Lag"`

7177

72 −It's better to use a rule like this:

78 +It's better to use a rule like this example:

7379

7480 - `user.city -startswith "Lag"`

7581

76 −

77 −## Next steps

82 +## Related content

7883

79 −- [Create a dynamic group](groups-dynamic-membership.md)

84 +- [Manage rules for dynamic membership groups in Microsoft Entra ID](groups-dynamic-membership.md)

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:37 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.