Understand and manage dynamic group processing
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 0bc81c2 · +31 −36 lines · also on GitHub
11
---
2
−title: Understanding and Managing Dynamic Group Processing in Microsoft Entra ID
2
+title: Understand and Manage Dynamic Group Processing in Microsoft Entra ID
33
description: Learn how dynamic group management works.
44
author: barclayn
55
manager: femila
⋯ 5 unchanged lines
1111
ms.reviewer: mbhargava
1212
---
1313
14
−# Understanding and Managing Dynamic Group Processing in Microsoft Entra ID
15
−
16
−Dynamic membership groups in Microsoft Entra are a powerful feature that allows administrators to automate group membership management. Changes to membership typically process within a few hours. However, under certain conditions, customers can experience delays in membership updates. Processing can take more than 24 hours. Understanding the underlying causes can help admins optimize their configurations and avoid unnecessary processing bottlenecks.
17
−
18
−## How Dynamic Group Processing Works
19
−
20
−Dynamic group processing operates in a sequential manner, meaning changes for a single tenant are evaluated and applied in order rather than all at once. Large volumes of changes, especially those affecting many users or devices, can lead to long processing queues, extending the time required for updates to be complete processing.
14
+# Understand and manage dynamic group processing in Microsoft Entra ID
2115
22
−### Key Factors Affecting Processing Time
16
+Dynamic membership groups in Microsoft Entra ID are a powerful feature that enables administrators to automate the management of group memberships. Changes to memberships are typically processed within a few hours.
2317
24
−The three biggest factors influencing processing that can cause membership updates to take longer are:
18
+However, under certain conditions, customers can experience delays in membership updates. Processing can take more than 24 hours. Understanding the underlying causes can help admins optimize their configurations and avoid unnecessary processing bottlenecks.
2519
26
−- **Number of dynamic groups**: Tenants with a large number of dynamic groups require more evaluations, increasing processing time.
20
+## How dynamic group processing works
2721
28
−- **Number of object changes**: A high volume of user or device changes can create a long processing queue, extending the time taken to complete processing. Some examples include: changes to extension attributes, device additions or removals, and bulk user updates.
22
+Dynamic group processing operates in a sequential manner. Changes for a single tenant are evaluated and applied in order, rather than all at once. Large volumes of changes, especially when they affect many users or devices, can lead to long processing queues. The long queues can extend the time required for updates to finish processing.
2923
30
−- **Rule configuration**: Certain rule configurations can affect processing time. For instance, the choice of inefficient operators like Match, Contains, or MemberOf can increase processing time. Rule complexity is also a contributing factor.
24
+### Key factors that affect processing time
3125
32
−## Best Practices to manage dynamic membership groups in your tenant
26
+The three biggest factors that influence processing and can cause membership updates to take longer are:
3327
34
−To ensure efficient processing and minimize delays, consider the following best practices:
28
+- **Number of dynamic groups**: Tenants that have a large number of dynamic groups require more evaluations, increasing processing time.
3529
36
−### **Monitor the number of dynamic membership groups in your tenant**:
30
+- **Number of object changes**: A high volume of user or device changes can create a long processing queue and extend the processing time. Examples include changes to extension attributes, device additions or removals, and bulk user updates.
3731
38
−Regularly review the number of groups in your tenant and delete inactive or outdated groups.
32
+- **Rule configuration**: Certain rule configurations can affect processing time. For instance, the choice of inefficient operators like `Match`, `Contains`, or `MemberOf` can increase processing time. Rule complexity is also a contributing factor.
3933
40
−### **Pause non-essential groups**:
34
+## Best practices for managing dynamic membership groups in your tenant
4135
42
−If you anticipate making a large number of changes to group membership (for example – changes to more than 500 groups or making over 20,000 membership changes), pause nonessential groups to improve processing performance.
36
+To help ensure efficient processing and minimize delays, consider the following best practices.
4337
44
−#### When to Pause Group Processing:
38
+### Monitor the number of dynamic membership groups in your tenant
4539
46
−- Planned large-scale updates: If you anticipate making a large number of changes to group membership (for example – changes to more than 500 groups or making over 20,000 membership changes).
40
+Regularly review the number of groups in your tenant. Delete inactive or outdated groups.
4741
48
−- Unexpected delays: if you notice that group membership hasn't changed/ you encounter unexpected delays.
42
+### Pause nonessential groups
4943
50
−#### How to Pause/resume:
44
+You can pause nonessential groups to improve processing performance. You might consider pausing group processing in these circumstances:
5145
52
−- Use the Pause All Groups script to temporarily halt processing and allow the service to recover before resuming.
46
+- **Planned large-scale updates**: You anticipate making a large number of changes to group membership. For example, you plan to make changes to more than 500 groups or make more than 20,000 membership changes.
47
+- **Unexpected delays**: You notice that group membership hasn't changed and you encounter unexpected delays.
5348
54
−- Don't unpause the groups immediately. We recommend waiting a minimum of 24 hours to allow group processing to catch up and then look at your audit logs to see if they are back to baseline. If necessary, unpause groups in phases rather than all at once.
49
+To temporarily halt processing, use the **Pause All Groups** script. Allow the service to recover before resuming.
5550
56
−### Optimizing Rule Efficiency
51
+Don't unpause the groups immediately. We recommend waiting a minimum of 24 hours to allow group processing to catch up. Then, check your audit logs to see if they're back to baseline. If necessary, unpause groups in phases rather than all at once.
5752
58
−- **Avoid the use of the Match operator** in rules as much as possible. Instead use the StartsWith, Equals, or EndsWith operators.
53
+### Optimize rule efficiency
5954
60
−- **Avoid Contains**: Similar to the use of Match, avoid the use of Contains operator in rules as much as possible as it can lead to increased processing time.
55
+- **Avoid Match**: Avoid the use of the `Match` operator in rules as much as possible. Instead, use the `StartsWith`, `Equals`, or `EndsWith` operator.
6156
62
−- **Use fewer OR operators**: Instead, use the -in operator to group them into a single criterion to make the rules easier to evaluate.
57
+- **Avoid Contains**: Similar to the use of `Match`, avoid the use of the `Contains` operator in rules as much as possible. It can lead to increased processing time.
6358
64
−- **Minimize use of MemberOf at this time**: [```memberOf```](groups-dynamic-rule-member-of.md), which is currently in preview, can introduce more complexity, particularly if a tenant has a large number of groups or frequent updates. Avoid using this operator if possible as it comes with bugs and limitations. The recommendation is to delete existing MemberOf groups in your tenant: Learn More
59
+- **Use fewer OR operators**: Instead, use the `-in` operator to group rules into a single criterion. Grouping rules makes them easier to evaluate.
6560
66
−>[!NOTE]
67
−> Review [Create simpler and more efficient rules](groups-dynamic-rule-more-efficient.md) to help you optimize dynamic group processing.
61
+- **Minimize the use of MemberOf (at this time)**: [`memberOf`](groups-dynamic-rule-member-of.md) is currently in preview. It can introduce more complexity, particularly if a tenant has a large number of groups or frequent updates. Avoid using this operator if possible, because it comes with bugs and limitations. The recommendation is to delete existing `MemberOf` groups in your tenant.
6862
63
+For more help with optimizing dynamic group processing, review [Create simpler, more efficient rules for dynamic membership groups in Microsoft Entra ID](groups-dynamic-rule-more-efficient.md).
6964
70
−## Other Troubleshooting Resources
65
+## Summary
7166
72
−Delays in dynamic group processing primarily happen due to high volumes of changes and large numbers of groups. By following best practices—such as optimizing rule efficiency, monitoring changes, and pausing nonessential groups when needed—IT administrators can improve processing performance and avoid unnecessary delays.
67
+Delays in dynamic group processing primarily happen due to high volumes of changes and large numbers of groups. By following best practices like optimizing rule efficiency, monitoring changes, and pausing nonessential groups when necessary, IT administrators can improve processing performance and avoid unnecessary delays.
7368
74
−## Related Articles
69
+## Related content
7570
7671
- [Manage rules for dynamic membership groups in Microsoft Entra ID](groups-dynamic-membership.md)
77
−- Review detailed information on pausing group processing in [Troubleshoot dynamic group processing](/troubleshoot/entra/entra-id/dir-dmns-obj/troubleshoot-dynamic-groups)
72
+- [Troubleshoot dynamic groups](/troubleshoot/entra/entra-id/dir-dmns-obj/troubleshoot-dynamic-groups)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.