Others

How to Automatically Add Users to a Group Based on Attributes in Microsoft Entra ID

Natalie Taylor Oct 20, 2026 869 views

Question details

Configure Microsoft Entra ID to automatically manage group memberships based on specific user attributes.

How to Automatically Add Users to a Group Based on Attributes in Microsoft Entra ID

Product: Microsoft Entra ID
Device & OS: not provided
Scenario: Administrators need to organize directories and manage access efficiently based on user properties like department, location, or job title without manually adding or removing users.
Observed behavior: The goal is to have users automatically added to or removed from a group as their directory attributes change, utilizing dynamic membership rules.

Before you start

Verify that your organization holds a Microsoft Entra ID P1 or Intune for Education license, as these are required to create and manage dynamic groups.

Solution 1Recommended

Create a Dynamic User Group in Azure Portal

Configure a dynamic group and set up an attribute-based query rule to manage membership automatically.

By setting the membership type to 'Dynamic User', Microsoft Entra ID will continuously evaluate user attributes against your defined rules. When a user's profile matches the rule syntax, they are instantly added to the group. If they no longer meet the criteria, they are automatically removed.

Access the Groups menu

Sign in to the Azure portal, navigate to Microsoft Entra ID (formerly Azure Active Directory), and select 'Groups' from the left-hand menu.

Initiate new group creation

Click on 'New group'. Fill in the basic details for the group, such as Group name and Group description.

Select dynamic membership type

Under the 'Membership type' dropdown, select 'Dynamic User' instead of Assigned. This unlocks the dynamic query builder.

Define the membership rule

Click 'Add dynamic query' under the Dynamic user members section. Use the rule builder to specify the property (e.g., department), operator (e.g., Equals), and value (e.g., IT). Once the rule syntax is complete, click 'Save' and then create the group.

Create a Dynamic User Group in Azure Portal

Rule Processing: After saving, the system will begin processing the rule to find matching users. It may take some time to populate the group depending on the size of your directory.

Free Microsoft Office alternative

Document Your IT Workflows with WPS Office

While managing Microsoft Entra ID requires the Azure portal, documenting your IT administration rules, deployment guides, and reports is seamless with WPS Office. As a free, lightweight alternative, it helps IT professionals efficiently manage office documents without expensive subscriptions.

Fully compatible with Microsoft Word, Excel, and PowerPoint file formats (.docx, .xlsx, .pptx).Lightweight installation and resource-friendly, perfect for IT deployment across enterprise workstations.Free to use, allowing teams to generate detailed IT documentation without licensing hurdles.Familiar user interface ensures a zero learning curve for users switching from Microsoft Office.

microsoft office alternative - wps office

Frequently Asked Questions

Can I change an existing static group to a dynamic group?

Yes, you can change a group's membership type from 'Assigned' to 'Dynamic User' in the Azure portal by going to the group's Properties, updating the Membership type, and adding a dynamic query rule.

How long does it take for a dynamic group to update when an attribute changes?

When a user's attribute is updated, Microsoft Entra ID evaluates the changes against all dynamic group rules. This update process typically takes anywhere from a few minutes to up to 24 hours depending on the size of the tenant.

What attributes can be used in dynamic group membership rules?

You can use a wide range of standard user attributes such as department, jobTitle, city, state, country, and userPrincipalName. Additionally, you can utilize custom extension attributes if they are configured in your directory.

Office Quick Solutions