Understand and manage dynamic group processing
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit e4e6b64 · +76 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: Understanding and Managing Dynamic Group Processing in Microsoft Entra ID
3
+description: Learn how dynamic group management works.
4
+author: barclayn
5
+manager: femila
6
+ms.service: entra-id
7
+ms.subservice: users
8
+ms.topic: conceptual
9
+ms.date: 04/01/2025
10
+ms.author: barclayn
11
+ms.reviewer: mbhargava
12
+---
13
+
14
+# Understanding and Managing Dynamic Group Processing in Microsoft Entra ID
15
+
16
+Dynamic membership groups in Microsoft Entra are a powerful tool for automating group membership. Changes to membership typically process within a few hours. However, under certain conditions, customers may experience delays in membership updates and processing may take more than 24 hours. Understanding the underlying causes can help admins optimize their configurations and avoid unnecessary processing bottlenecks.
17
+
18
+## How Dynamic Group Processing Works
19
+
20
+Dynamic group processing operates in a sequential manner, meaning changes for a single tenant are evaluated and applied in order rather than all at once. Large volumes of changes, especially those affecting many users or devices, can lead to long processing queues, extending the time required for updates to be complete processing.
21
+
22
+### Key Factors Affecting Processing Time
23
+
24
+The three biggest factors influencing processing that can cause membership updates to take longer are:
25
+
26
+- **Number of dynamic groups**: Tenants with a large number of dynamic groups require more evaluations, increasing processing time.
27
+
28
+- **Number of object changes**: A high volume of user or device changes can create a long processing queue, extending the time taken to complete processing. Some examples include: changes to extension attributes, device additions or removals, and bulk user updates.
29
+
30
+- **Rule configuration**: Certain rule configurations can impact processing time. For instance, the choice of inefficient operators like Match, Contains or MemberOf can increase processing time. Rule complexity is also a contributing factor.
31
+
32
+## Best Practices to manage dynamic membership groups in your tenant
33
+
34
+To ensure efficient processing and minimize delays, consider the following best practices:
35
+
36
+### **Monitor the number of dynamic membership groups in your tenant**:
37
+
38
+Regularly review the number of groups in your tenant and delete inactive or outdated groups.
39
+
40
+### **Pause non-essential groups**:
41
+
42
+If you anticipate making a large number of changes to group membership (for example – changes to more than 500 groups or making over 20,000 membership changes), pause non-essential groups to improve processing performance.
43
+
44
+#### When to Pause Group Processing:
45
+
46
+- Planned large-scale updates: If you anticipate making a large number of changes to group membership (for example – changes to more than 500 groups or making over 20,000 membership changes).
47
+
48
+- Unexpected delays: if you notice that group membership has not changed/ you encounter unexpected delays.
49
+
50
+#### How to Pause/resume:
51
+
52
+- Use the Pause All Groups script to temporarily halt processing and allow the service to recover before resuming.
53
+
54
+- Do not un-pause the groups immediately. We recommend waiting a minimum of 24 hours to allow group processing to catch up and then look at your audit logs to see if they have returned to baseline. If necessary, un-pause groups in phases rather than all at once.
55
+
56
+### Optimizing Rule Efficiency
57
+
58
+- **Avoid the use of the Match operator** in rules as much as possible. Instead use the StartsWith, Equals or EndsWith operators.
59
+
60
+- **Avoid Contains**: Similar to the use of Match, avoid the use of Contains operator in rules as much as possible as it can lead to increased processing time.
61
+
62
+- **Use fewer OR operators**: Instead, use the -in operator to group them into a single criterion to make the rules easier to evaluate.
63
+
64
+- **Minimize use of MemberOf at this time**: [```memberOf```](groups-dynamic-rule-member-of.md), which is currently in preview, can introduce additional complexity, particularly if a tenant has a large number of groups or frequent updates. Avoid using this operator if possible as it comes with bugs and limitations. The recommendation is to delete existing MemberOf groups in your tenant: Learn More
65
+
66
+>[!NOTE]
67
+> Learn more about creating efficient rules here: [](groups-dynamic-rule-more-efficient.md)
68
+
69
+
70
+
71
+## Additional Troubleshooting Resources
72
+
73
+Delays in dynamic group processing primarily happen due to high volumes of changes and large numbers of groups. By following best practices—such as optimizing rule efficiency, monitoring changes, and pausing non-essential groups when needed—IT administrators can improve processing performance and avoid unnecessary delays.
74
+
75
+>[!NOTE]
76
+> Review detailed information on pausing group processing in [Troubleshoot dynamic group processing](/troubleshoot/entra/entra-id/dir-dmns-obj/troubleshoot-dynamic-groups.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.