Edit

Validate a dynamic group membership rule (preview) in Microsoft Entra ID

  • Article

Microsoft Entra ID provides the means to validate dynamic group rules (in public preview). On the Validate rules tab, you can validate your dynamic rule against sample group members to confirm the rule is working as expected. When you create or update dynamic group rules, you want to know whether a user or a device will be a member of the group. This knowledge helps you evaluate whether a user or device meets the rule criteria and help you troubleshoot when membership isn't expected.

Prerequisites

To evaluate the dynamic group rule membership feature, the administrator must have one of the following rules assigned directly: Global Administrator, Groups Administrator, or Intune Administrator.

Tip

Assigning one of required roles via indirect group membership is not yet supported.

To validate a dynamic group membership rule

To get started, sign in to the Microsoft Entra admin center as at least a Groups Administrator.

  1. Browse to Identity > Groups > All groups.

  2. Select an existing dynamic group or create a new dynamic group and select Dynamic membership rules. You can then see the Validate Rules tab.

    Screenshot of finding the Validate rules tab and start with an existing rule.

  3. On the Validate rules tab, select users to validate their memberships. 20 users or devices can be selected at one time.

    Screenshot of adding users to validate the existing rule against.

  4. After you select users or devices from the picker, and then Select, validation automatically starts and validation results appear.

    Screenshot of viewing the results of the rule validation.

  5. The results show whether a user is a member of the group or not. If the rule isn't valid or if there's a network issue, the results show as Unknown. If the value is Unknown, the detailed error message describes the issue and actions needed.

    Screenshot of viewing the details of the results of the rule validation.

  6. You can modify the rule to trigger a new validation of memberships. To see why user isn't a member of the group, select View details and verification details show the result of each expression composing the rule. Then select OK to exit.

Next steps