Entra dynamic membership rules and the memberOf operator
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5571eaa · +14 −1 lines · also on GitHub
⋯ 1 unchanged line
22
title: Manage Rules for Dynamic Membership Groups in Microsoft Entra ID
33
description: Learn how to manage rules for dynamic membership groups to automatically populate group members and rule references.
44
ms.topic: how-to
5
−ms.date: 12/19/2024
5
+ms.date: 03/05/2026
66
ms.reviewer: krbain
77
ms.custom: it-pro
8
+ai-usage: ai-assisted
89
---
910
1011
# Manage rules for dynamic membership groups in Microsoft Entra ID
⋯ 13 unchanged lines
2425
2526
- You can create a dynamic membership groups for users or devices, but you can't create a rule that contains both users and devices.
2627
- You can't create a device membership group based on the user attributes of the device owner. Device membership rules can reference only device attributes.
28
+
29
+### Security consideration: Evaluate attribute write permissions before using them in dynamic group rules
30
+
31
+When you create a dynamic membership rule, you effectively delegate control of that group's membership to anyone who can modify the attributes referenced in the rule. Before selecting an attribute for a dynamic group rule, verify that only authorized administrators can update its value. This is especially important for:
32
+
33
+- **Attributes synced from on-premises Active Directory.** Some on-premises attributes might be configured with permissions that allow users to modify their own values (SELF write).
34
+- **Groups used for access control.** If a dynamic group controls access to sensitive resources, applications, or Conditional Access policies, the security of that access is only as strong as the write controls on the attributes in the rule.
35
+
36
+As a best practice, audit the write permissions for any attribute you plan to use in a dynamic membership rule, both in Microsoft Entra ID and at the source (such as on-premises Active Directory). Restrict self-service write access to attributes used in security-sensitive groups.
37
+
38
+> [!NOTE]
39
+> Role-assignable groups already prevent this risk by requiring assigned (not dynamic) membership.
2740
2841
### License requirements
2942
⋯ 461 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.