Exclude user from a dynamic group based on group membership

John Oliveros 26

Hi,

I have a dynamic group with few of users that I wanted to exclude based on the group (Membership Type: Assigned) they belong to.

I am playing around this paramater user.memberof -any (group.objectId -in ['value']) but can't get it to work.

First three parameters are working but when I include user.memberof it started to fail.

Any thoughts around this? Is this even feasible?

Shweta Mathur 30,426 Reputation points Microsoft Employee Moderator

2022-10-31T13:28:40.127+00:00

Hi @John Oliveros ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta
Randy Schwidder (Privé) 6 Reputation points

2022-12-19T16:08:22.853+00:00
I've got the same question and what I understand it is not posible yet. See the limitations mentioned:

Preview limitations

Each Azure AD tenant is limited to 500 dynamic groups using the memberOf attribute. memberOf groups do count towards the total dynamic group member quota of 5,000.

Each dynamic group can have up to 50 member groups.

When adding members of security groups to memberOf dynamic groups, only direct members of the security group become members of the dynamic group.

You can't use one memberOf dynamic group to define the membership of another memberOf dynamic groups. For example, Dynamic Group A, with members of group B and C in it, can't be a member of Dynamic Group D).

MemberOf can't be used with other rules. For example, a rule that states dynamic group A should contain members of group B and also should contain only users located in Redmond will fail.

Dynamic group rule builder and validate feature can't be used for memberOf at this time.

MemberOf can't be used with other operators. For example, you can't create a rule that states “Members Of group A can't be in Dynamic group B.”

The objects specified in the rule can't be administrative units.

6 answers

David Read 0 Reputation points

2025-09-25T01:59:53.57+00:00

and here we are - 3 years later and still can't do something as simple as defining which groups to include and which to exclude from a Dynamic Group!!!
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Exclude user from a dynamic group based on group membership

6 answers

Your answer