Creating a Dynamic Group

Question

I am trying to configure a entra group to include members of a specific group but exclude members of another group. I am running into problem creating the dynamic rules in order to pull the correct members. Any help here would be appreciated.

Answer 1

The memberOf rule cant be configured like that currently:

https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-rule-member-of#preview-limitations

Answer 2

You can't automatically create a group in Entra that includes members of one group but removes those in another. This type of rule isn’t supported. To work around Entra’s limitations, use user attributes to define dynamic group membership. For example, filter by department or job title to include or exclude users:

(user.department -eq "Sales") -and (user.jobTitle -ne "Contractor")

If no useful attribute exists, manage exclusions manually by creating a separate group for users you want to exclude.
If this helped clarify the limitation and offered a useful workaround, please consider giving it a thumbs up or marking it as helpful—your feedback supports the community and helps others find clear answers faster!