Azure Dynamic Group Stopped Processing Changes

Question

Hi Everyone, I'm a little new to the whole Azure world, so I apologize if I don't provide enough information for my problem. 5 days ago, 04/06/2023, I recently created 5 Azure groups initially with the Assigned membership. Then 3 days later on 04/09/2023, we thought it would be even more efficient for us to turn the groups into the Dynamic membership type. This was actually really easy to do and I only needed to add the membership rules. After seeing the new dynamic groups keep the same users as intended, we thought we were in the clear. However, I was informed by an employee today who originally was part of the assigned group that she no longer had access to the dynamic groups files in Microsoft Teams. After looking in Azure, I noticed I had forgotten to adjust her extensionAttribute from our local AD to match was used in the dynamic rule for that group. I updated the attribute for her account in our local AD, ran the Azure AD sync on our local prem server, and validated her account with the group's Validation Rules feature. I got the green check and everything, indication she SHOULD be added to the group again. After waiting 5 minutes and refreshing throughout, she still wasn't being added back into the group. I checked to make sure the Microsoft Azure AD Sync service was running on our Connect server, even rebooted the entire thing and confirmed again the service was running, ran the command for the sync in Powershell, and the user was still not being added to the group. I then realized that in the Overview section of the group that I am trying to add the user to, it lists the last membership change as the same day the group was changed to dynamic, 04/09/2023 and about 5 hours after I changed the groups to dynamic. It's sounding like for whatever reason, the dynamic group (and actually all 5) have stopped processing changes. Yes, I made sure to check that the "Pause Processing" icon wasn't checked. I'm not entirely sure what else to try with this situation. The groups were working and processing changes for the whole 5 hours post-dynamic change, and I can see the Audit logs confirming things were working. Then the time stamp of 5 hours hits and then there's no other logs that appear. I don't even have any "failed" logs in the audit logs. I appreciate any help or guidance that anyone can provide.

Answer 1

The process of updating Dynamic group membership is asynchronous and can take up to 24 hours. The only "trick" you can use to speed up the process is do a "dummy" update on the rule, such as adding a space at the end. But it will still not be instantaneous. For more troubleshooting steps, refer to: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-troubleshooting#troubleshooting-dynamic-memberships-for-groups