Create dynamic groups in Azure Active Directory B2B collaboration

Artikkeli
05/22/2023

What are dynamic groups?

A dynamic group is a dynamic configuration of security group membership for Azure Active Directory (Azure AD) available in the Azure portal. Administrators can set rules to populate groups that are created in Azure AD based on user attributes (such as userType, department, or country/region). Members can be automatically added to or removed from a security group based on their attributes. These groups can provide access to applications or cloud resources (SharePoint sites, documents) and to assign licenses to members. Learn more about dedicated groups in Azure Active Directory.

Prerequisites

Azure AD Premium P1 or P2 licensing is required to create and use dynamic groups. Learn more in Create attribute-based rules for dynamic group membership in Azure Active Directory.

Creating an "all users" dynamic group

You can create a group containing all users within a tenant using a membership rule. When users are added or removed from the tenant in the future, the group's membership is adjusted automatically.

Sign in to the Azure portal with an account that is assigned the Global administrator or User administrator role in the tenant.
Select Azure Active Directory.
Under Manage, select Groups, and then select New group.
On the New Group page, under Group type, select Security. Enter a Group name and Group description for the new group.
Under Membership type, select Dynamic User, and then select Add dynamic query.
Above the Rule syntax text box, select Edit. On the Edit rule syntax page, type the following expression in the text box:
```
user.objectId -ne null
```
Select OK. The rule appears in the Rule syntax box:
Select Save. The new dynamic group will now include B2B guest users and member users.
Select Create on the New group page to create the group.

Creating a group of members only

If you want your group to exclude guest users and include only members of your tenant, create a dynamic group as described above, but in the Rule syntax box, enter the following expression:

(user.objectId -ne null) and (user.userType -eq "Member")

The following image shows the rule syntax for a dynamic group modified to include members only and exclude guests.

Creating a group of guests only

You might also find it useful to create a new dynamic group that contains only guest users, so that you can apply policies (such as Azure AD Conditional Access policies) to them. Create a dynamic group as described above, but in the Rule syntax box, enter the following expression:

(user.objectId -ne null) and (user.userType -eq "Guest")

The following image shows the rule syntax for a dynamic group modified to include guests only and exclude member users.