Dynamic group
Dynamic group is the group which adds and removes group members automatically using membership rules based on member attributes.
We can create complex attribute-based rules to enable dynamic memberships for groups.
Dynamic group membership reduces the administrative overhead of adding and removing users.
To create a Dynamic Security Group, follow the below steps:
Log into Azure portal (https://portal.azure.com/) or Intune portal (https://endpoint.microsoft.com/)
Go to Groups, Click New group.
Choose Security as group type.
Give the security group a Name, and a Description (Optional)
Choose Dynamic device as Membership type
Click the Add dynamic query tab
Choose attribute (Ex: enrollmentprofilename) in the first drop down list (Property)
Choose condition (Ex: match) from the second drop down list (Operator)
In the third field (value) enter the Value (ex: enrollment profile name)
Click Add query – click Save
Click on Create and your Group will be created.
Members will get automatically added/removed as per membership rules.
Few examples of Dynamic Menmbership rule syntax –
user.department -eq “Sales“,
user.country -eq “value“,
user.objectId -ne null,
(user.objectId -ne null)
-and (user.userType -eq “Member”),
device.objectId -ne null,
Note: We can create a dynamic group for devices or for users, but we can’t create a rule that contains both users and devices.
We can’t create a device group based on the device owners’ attributes. Device membership rules can only reference device attributes.
