Entra dynamic membership rules and the memberOf operator
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit af37138 · +6 −2 lines · also on GitHub
⋯ 1 unchanged line
22
title: Manage rules for dynamic membership groups in Microsoft Entra ID
33
description: Learn how to manage rules for dynamic membership groups to automatically populate group members and rule references.
44
ms.topic: how-to
5
−ms.date: 03/05/2026
6
−ms.reviewer: yukarppa
5
+ms.date: 08/13/2026
6
+ms.reviewer: mbhargav
77
ms.custom: it-pro
88
ai-usage: ai-assisted
99
---
⋯ 6 unchanged lines
1616
You can create user-based or device attribute-based rules to enable membership for dynamic membership groups in Microsoft Entra ID. You can add and remove dynamic membership groups automatically by using membership rules based on member attributes. In Microsoft Entra, a single tenant can have a maximum of 15,000 dynamic membership groups.
1717
1818
This article details the properties and syntax to create rules for dynamic membership groups based on users or devices.
19
+
20
+An agent's user account is a subtype of user identity within Microsoft Entra. An agent's user account is evaluated by user-based membership rules and can be included in a dynamic user group when it satisfies the rule.
21
+
22
+By default, an agent's user account isn't distinguished from other user identities. To exclude these accounts, include a condition in the membership rule. You can also create rules that include only agents' user accounts or target accounts associated with a specific agent identity blueprint. Agent identities, which are service principals, aren't supported as members of dynamic membership groups.
1923
2024
> [!NOTE]
2125
> Security groups can include either devices or users, but Microsoft 365 groups can include only users.
⋯ 513 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.