Validate a dynamic group membership rule (preview) in Azure Active Directory

Azure Active Directory (Azure AD), part of Microsoft Entra, now provides the means to validate dynamic group rules (in public preview). On the Validate rules tab, you can validate your dynamic rule against sample group members to confirm the rule is working as expected. When you create or update dynamic group rules, you want to know whether a user or a device will be a member of the group. This knowledge helps you evaluate whether a user or device meets the rule criteria and help you troubleshoot when membership isn't expected.

Prerequisites

To evaluate the dynamic group rule membership feature, the administrator must have one of the following rules assigned directly: Global Administrator, Groups Administrator, or Intune Administrator.

Tip

Assigning one of required roles via indirect group membership is not yet supported.

Step-by-step walk-through

To get started, go to Azure Active Directory > Groups. Select an existing dynamic group or create a new dynamic group and select Dynamic membership rules. You can then see the Validate Rules tab.

On Validate rules tab, you can select users to validate their memberships. 20 users or devices can be selected at one time.

After you select users or devices from the picker, and Select, validation will automatically start and validation results will appear.

The results tell whether a user is a member of the group or not. If the rule isn't valid or there's a network issue, the result will show as Unknown. If the value is Unknown, the detailed error message will describe the issue and actions needed.

You can modify the rule and validation of memberships will be triggered. To see why user isn't a member of the group, select View details and verification details will show the result of each expression composing the rule. Select OK to exit.

Next steps

• Dynamic membership rules for groups