Understanding Dynamic Membership for Entra ID Groups

• Entra ID supports dynamic membership for users and devices in some types of groups.
• The feature makes groups very powerful and flexible but requires paid tiers of Entra ID P1.
• Not all types of groups support dynamic membership.
• Only security groups support devices and device-based dynamic membership.

Entra ID dynamic membership for groups is ideal for managing users, applications, and licenses, without the manual management required by traditional security groups. Dynamic membership for groups is available in the Entra ID section of the Azure portal and some Microsoft 365 administration portals. Dynamic membership requires Entra ID P1 or P2 User Subscription Licenses (User SLs) for administrators managing dynamic memberships, and for all users contained within security groups or Microsoft 365 groups configured for dynamic membership.

Managing Groups

Entra ID supports the creation of security groups, as with Active Directory Domain Services (AD DS) on-premises. Historically, administrators either manually add users to the correct groups or run PowerShell scripts to add users. In Entra ID, security groups are useful for managing access to Office 365 and other applications, resources in Azure, and licenses for most Microsoft hosted applications. To make Entra ID group management easier, Microsoft has added dynamic membership features for both security groups and Microsoft 365 groups.