Skip to main content
Group accounts in Microsoft Entra ID (Azure AD) are essential for organizing users and devices, simplifying permissions, and enforcing access policies across your tenant. This article explains group types, membership (assignment) options, how to create and manage groups in the Azure portal, and practical examples for dynamic user and device groups.

​
Overview

  • Why groups matter: centralize access control, simplify role assignments, enable collaboration features (Microsoft 365 groups), and automate membership with dynamic rules.
  • When to use: use security groups for access control, Microsoft 365 groups for collaboration, and dynamic groups to reduce administrative overhead.

​
Group types

  • Security groups are ideal for access management across Azure resources and enterprise applications.
  • Microsoft 365 groups automatically provision collaboration tools (Teams, Outlook, SharePoint, OneDrive).
A slide titled "Group Accounts" showing the Azure Active Directory Groups management screen on the left and panels on the right listing Group Types (Security groups, Microsoft 365 groups) and Assignment Types (Assigned, Dynamic user, Dynamic device).
Choose the group type that aligns with your goals—security enforcement or collaboration—and then select the appropriate membership model.
Dynamic membership rules automate group membership but depend on accurate user and device attributes. Keep attributes like department, usageLocation, and device OS up to date for predictable results.

​
Assignment (membership) types

  • Assigned groups: explicit membership management; admins add or remove users.
  • Dynamic groups: rules are evaluated automatically; membership changes when attributes change.
  • Dynamic device membership is supported for security groups only (not Microsoft 365 groups).

​
Creating groups in the Azure portal

Steps to create a group:
  1. In the Azure portal, go to Microsoft Entra ID (Azure AD) → Groups.
  2. Click + New group.
  3. Configure:
    • Group type: Security or Microsoft 365
    • Group name and description
    • Option to allow this group to be assigned Entra ID roles (enable only when required)
    • Membership type: Assigned, Dynamic User, or Dynamic Device
    • Owners and members (for assigned groups)
  4. Click Create when finished.
Example: creating a security group named Hiring managers
  • Group type: Security
  • Membership type: Assigned
  • The creator is the default owner (you can add more owners)
  • Add members manually or add existing groups to nest groups
Screenshot of the Microsoft Azure portal showing the "New Group" creation screen for a "Hiring Managers" security group. The right pane shows the Add members dialog with a "DevRel" group selected and several members listed.
Notes:
  • Owners can add/remove members and manage group settings.
  • Nested groups are supported: add an existing group (e.g., DevRel) as a member of another group to simplify management.

​
Bulk-creating users (prepare attributes for dynamic groups)

If you plan to use dynamic user groups, prepare users with consistent attributes (for example department and usageLocation) using Azure AD’s bulk create feature. Steps to bulk-create users:
  1. Prepare a CSV with required attributes (Display Name, User Principal Name, Department, Usage Location, etc.).
  2. In Azure portal: Users → Bulk operations → Bulk create.
  3. Upload the CSV, submit the job, and monitor the results.
  4. Verify the created accounts and attribute values before relying on them in dynamic rules.
A screenshot of the Microsoft Azure (Azure Active Directory) Users page showing a table of user accounts with columns for display name, user principal name, user type, identities and company. A right-hand pane for bulk creating users (CSV download/upload) and a left navigation menu are also visible.
Check the bulk job status and details:
A screenshot of the Microsoft Azure portal on the "Users | Bulk operation results" page showing a table of uploaded CSV jobs (UserCreateTemplate.csv, UserDelete.csv) with upload/completion times, statuses, and success counts. The left sidebar shows user management options like All users, Audit logs, and Deleted users.
Using bulk upload helps ensure attributes used by dynamic membership rules are set consistently across many accounts.

​
Dynamic user groups — example: “Avengers”

To create a dynamic user group:
  1. Create a new group: Group type = Security, Membership type = Dynamic User.
  2. Click Add dynamic query to build the membership rule based on user attributes.
  3. Use expressions and logical operators (and, or) to construct the rule.
Example rule (users with department = Avengers and usageLocation = US):
  • After saving, Azure evaluates the rule and adds matching users automatically.
  • Users are removed automatically when their attributes no longer match.
  • Use Validate rules to test whether a specific user meets the rule conditions and to troubleshoot mismatches.
Screenshot of the Microsoft Azure portal's "New Group" creation page. It shows form fields with Group type set to Security, Group name "Avengers", Membership type "Dynamic User", and an "Add dynamic query" option.
After creation, inspect members to confirm membership is correct:
A screenshot of the Microsoft Azure portal showing the "Avengers" Azure AD group membership page. It lists direct members (names like Ant‑Man, Black Panther, Captain America, Spider‑Man, etc.) with columns for Type and User type.
Example troubleshooting: if Gamora has usageLocation = US but department = Guardians of the Galaxy, she will not be included by the rule above because department does not equal Avengers. Use rule validation to confirm exactly which clause fails.

​
Dynamic device groups

Dynamic device groups use device attributes and are supported only for security groups. Common device attributes: deviceOSType, deviceOwnership, OS version, and manufacturer. Example rule to include Windows devices:
  • Devices matching the rule are added automatically and removed when they no longer match.
  • Useful for targeted policies, software deployment, or compliance workflows.
Screenshot of the Microsoft Azure portal on the "Dynamic membership rules" page. It shows a rule being configured with property "deviceOSType" set to "Equals" and value "Windows," with the rule syntax box below.
Dynamic groups require proper licensing (Azure AD Premium P1) and accurate attribute data. Dynamic device membership is supported only for security groups—not Microsoft 365 groups.

​
Additional group management features

  • Deleted groups: groups are soft-deleted and can be restored from a recycle bin-like view.
  • Expiration policies: configure automatic group expiration and renewal processes.
  • Naming and membership policies: restrict group names (blocked words) and apply rules to control group creation and membership.
That covers the core group management features in Microsoft Entra ID (Azure AD). For more on dynamic membership syntax, group-based licensing, and advanced group management consider these resources: Note: Self-Service Password Reset (SSPR) and other identity features are related but handled in separate lessons.

Watch Video