Dynamic group

Dynamic group is the group which adds and removes group members automatically using membership rules based on member attributes.

We can create complex attribute-based rules to enable dynamic memberships for groups.

Dynamic group membership reduces the administrative overhead of adding and removing users. 

To create a Dynamic Security Group, follow the below steps:

Log into Azure portal (https://portal.azure.com/) or Intune portal (https://endpoint.microsoft.com/)

Go to Groups, Click New group.

Choose Security as group type.

Give the security group a Name, and a Description (Optional)

Choose Dynamic device as Membership type

Click the Add dynamic query tab

Choose attribute (Ex: enrollmentprofilename) in the first drop down list (Property)

Choose condition (Ex: match) from the second drop down list (Operator)

In the third field (value) enter the Value (ex: enrollment profile name)

Click Add query – click Save

Click on Create and your Group will be created. 

Members will get automatically added/removed as per membership rules.

Few examples of Dynamic Menmbership rule syntax –

user.department -eq “Sales“,

user.country -eq “value“,

user.objectId -ne null,

(user.objectId -ne null)
-and (user.userType -eq “Member”),

device.objectId -ne null,

Note: We can create a dynamic group for devices or for users, but we can’t create a rule that contains both users and devices.

We can’t create a device group based on the device owners’ attributes. Device membership rules can only reference device attributes.

 Details and reference link –  https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership