Entra dynamic membership rules and the memberOf operator

This page's changes and edits · All guidance changes

Microsoft's edit · 17 Mar 16:37 UTC

Editorial pass: dynamic groups articles (33 fixes)

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 79ce023 · +13 ~~−11~~ lines · also on GitHub

11 ---

2 −title: Manage Rules for Dynamic Membership Groups in Microsoft Entra ID

2 +title: Manage rules for dynamic membership groups in Microsoft Entra ID

33 description: Learn how to manage rules for dynamic membership groups to automatically populate group members and rule references.

44 ms.topic: how-to

55 ms.date: 03/05/2026

⋯ 17 unchanged lines

2323

2424 Also keep these limitations in mind:

2525

26 −- You can create a dynamic membership groups for users or devices, but you can't create a rule that contains both users and devices.

26 +- You can create dynamic membership groups for users or devices, but you can't create a rule that contains both users and devices.

2727 - You can't create a device membership group based on the user attributes of the device owner. Device membership rules can reference only device attributes.

2828

2929 ### Security consideration: Evaluate attribute write permissions before using them in dynamic group rules

⋯ 52 unchanged lines

8282

8383 Parentheses are optional for a single expression. The total length of the body of your membership rule can't exceed 3,072 characters.

8484

85 −### Constructing the body of a membership rule

85 +### Construct the body of a membership rule

8686

8787 A membership rule that automatically populates a group with users or devices is a binary expression that results in a true or false outcome. The three parts of a simple rule are:

8888

⋯ 91 unchanged lines

180180 | `In` | `-in` |

181181 | `Not In` | `-notIn` |

182182

183 −#### Using the -in and -notIn operators

183 +#### Use the -in and -notIn operators

184184

185185 If you want to compare the value of a user attribute against multiple values, you can use the `-in` or `-notIn` operator. Use the bracket symbols (`[` and `]`) to begin and end the list of values.

186186

⋯ 3 unchanged lines

190190 user.department -in ["50001","50002","50003","50005","50006","50007","50008","50016","50020","50024","50038","50039","51100"]

191191 ```

192192

193 −#### Using the -le and -ge operators

193 +#### Use the -le and -ge operators

194194

195195 You can use the less than (`-le`) or greater than (`-ge`) operator when you're using the `employeeHireDate` attribute in rules for dynamic membership groups.

196196

⋯ 6 unchanged lines

203203

204204 ```

205205

206 −#### Using the -match operator

206 +#### Use the -match operator

207207

208208 You can use the `-match` operator for matching any regular expression.

209209

⋯ 92 unchanged lines

302302 | `assignedPlans` | Each object in the collection exposes the following string properties: `capabilityStatus`, `service`, `servicePlanId` | ```user.assignedPlans -any (assignedPlan.servicePlanId -eq "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e" -and assignedPlan.capabilityStatus -eq "Enabled")```|

303303 | `proxyAddresses` | `SMTP: alias@domain`, `smtp: alias@domain` | ```(user.proxyAddresses -any (\_ -startsWith "contoso"))``` |

304304

305 −#### Using the -any and -all operators

305 +#### Use the -any and -all operators

306306

307307 You can use the following operators to apply a condition to one or all of the items in the collection:

308308

⋯ 26 unchanged lines

335335 user.assignedPlans -all (assignedPlan.servicePlanId -eq null)

336336 ```

337337

338 −#### Using the underscore (\_) syntax

338 +#### Use the underscore (\_) syntax

339339

340340 The underscore (`_`) syntax matches occurrences of a specific value in one of the multi-value string collection properties to add users or devices to a dynamic membership group. You use it with the `-any` or `-all` operator.

341341

⋯ 5 unchanged lines

347347

348348 ### Other properties and common rules

349349

350 +The following sections describe other common rule patterns for dynamic membership groups.

351 +

350352 #### Create a rule for direct reports

351353

352354 You can create a group that contains all direct reports of a manager. When the manager's direct reports change in the future, the group's membership is adjusted automatically.

353355

354 −>[!NOTE]

356 +> [!NOTE]

355357 > The manager is also added to a direct reports dynamic group.

356358

357359 You construct the direct reports rule by using the following syntax:

⋯ 138 unchanged lines

496498

497499 3 When you use `extensionAttribute1-15` to create dynamic membership groups for devices, you need to set the value for `extensionAttribute1-15` on the device. [Learn more about how to write `extensionAttributes` on a Microsoft Entra device object](/graph/api/device-update?view=graph-rest-1.0&tabs=http&preserve-view=true#example-2--write-extensionattributes-on-a-device).

498500

499 −4 When you use `systemLabels`, a read-only attribute that's used in various contexts (such as device management and sensitivity labeling) is not editable through Intune.

501 +4 When you use `systemLabels`, a read-only attribute that's used in various contexts (such as device management and sensitivity labeling) isn't editable through Intune.

500502

501503 ## Related content

502504

503505

504 −- [Manage Microsoft Entra groups and group membership](/entra/fundamentals/how-to-manage-groups)

506 +- [Manage Microsoft Entra groups and group membership](~/fundamentals/how-to-manage-groups.yml)

505507 - [Create or update a dynamic membership group in Microsoft Entra ID](groups-create-rule.md)

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.