Entra dynamic membership rules and the memberOf operator

This page's changes and edits · All guidance changes

Microsoft's edit · 6 Mar 16:12 UTC

Update security consideration wording for dynamic group rules

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 683fa20 · +4 −2 lines · also on GitHub

⋯ 27 unchanged lines

2828

2929 ### Security consideration: Evaluate attribute write permissions before using them in dynamic group rules

3030

31 −When you create a dynamic membership rule, you effectively delegate control of that group's membership to anyone who can modify the attributes referenced in the rule. Before selecting an attribute for a dynamic group rule, verify that only authorized administrators can update its value. This is especially important for:

31 +When you create a dynamic membership rule, the security of that group's membership depends on who can modify the attributes referenced in the rule. Before selecting an attribute, review the write permissions for that attribute—both in Microsoft Entra ID and in any connected source directories.

3232

33 +This is especially important for:

34 +

3335 - **Attributes synced from on-premises Active Directory.** Some on-premises attributes might be configured with permissions that allow users to modify their own values (SELF write).

3436 - **Groups used for access control.** If a dynamic group controls access to sensitive resources, applications, or Conditional Access policies, the security of that access is only as strong as the write controls on the attributes in the rule.

3537

36 −As a best practice, audit the write permissions for any attribute you plan to use in a dynamic membership rule, both in Microsoft Entra ID and at the source (such as on-premises Active Directory). Restrict self-service write access to attributes used in security-sensitive groups.

38 +As a best practice, audit the write permissions for all entity types and their attributes you plan to use in a dynamic membership rule, both in Microsoft Entra ID and at the source (such as on-premises Active Directory). Restrict self-service write access to attributes used in security-sensitive groups.

3739

3840 > [!NOTE]

3941 > Role-assignable groups already prevent this risk by requiring assigned (not dynamic) membership.

⋯ 464 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.