---
title: "AZ-104 Deep Dive: Dynamic Membership in Microsoft Entra ID"
description: "One of the most critical tasks in Lab 01 - and a frequent stumbling block on the actual exam - is configuring Dynamic Groups. We break down the licensing requirements, membership types, and rule syntax."
canonical: "https://zainahmed.net/blog/az-104-dynamic-membership-entra-id"
published: "2025-12-22"
---

# AZ-104 Deep Dive: Dynamic Membership in Microsoft Entra ID

> Author: Zain Ahmed
> Published: 2025-12-22
> Read Time: 8 min read
> Category: Identity & Access Management
> Tags: Azure, Entra ID, AZ-104, Identity, Dynamic Groups, Automation
> Canonical URL: https://zainahmed.net/blog/az-104-dynamic-membership-entra-id

## Excerpt
One of the most critical tasks in Lab 01 - and a frequent stumbling block on the actual exam - is configuring Dynamic Groups. We break down the licensing requirements, membership types, and rule syntax.

---

In **Lab 01 - Manage Microsoft Entra ID Identities**, one of the most critical tasks - and a frequent stumbling block on the actual exam - is configuring **Dynamic Groups**.

While creating a standard "Assigned" group is straightforward, Dynamic Membership introduces automation based on user or device attributes. However, before you even write your first query, there is a strict prerequisite that Microsoft loves to test you on.

## 1. The Critical Exam "Gotcha": Licensing

You cannot configure Dynamic Membership with the default "Free" tier of Microsoft Entra ID (formerly Azure AD).

<div className="my-6 p-4 border-l-4 border-yellow-500 bg-yellow-500/10 rounded-none">
  <div className="flex items-center gap-2 font-bold text-yellow-600 mb-2">
    <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" className="lucide lucide-triangle-alert"><path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3Z"/><path d="M12 9v4"/><path d="M12 17h.01"/></svg>
    Exam Alert
  </div>
  <p className="text-sm text-yellow-700/90 dark:text-yellow-500/90 !mt-0">
    An <strong>Entra ID Premium P1 or P2 license</strong> is required for Dynamic Membership.
  </p>
</div>

If you are in the Azure Portal and the "Membership type" dropdown is grayed out or missing the "Dynamic User" option, it is almost always because the tenant lacks a Premium license.

![Microsoft Entra ID New Group Screen showing grayed out Membership Type](/assets/images/articles/entra-id-group-creation.webp)

<div className="my-8 rounded-none border bg-card text-card-foreground shadow-none overflow-hidden">
  <div className="bg-muted/50 p-4 border-b flex items-center gap-2">
     <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" className="lucide lucide-graduation-cap"><path d="M22 10v6M2 10l10-5 10 5-10 5z"/><path d="M6 12v5c3 3 9 3 12 0v-5"/></svg>
     <span className="font-semibold">Common Exam Scenario</span>
  </div>
  <div className="p-6 space-y-4">
    <div className="flex gap-4">
       <div className="shrink-0 flex h-8 w-8 items-center justify-center rounded-none bg-primary/10 text-primary font-bold text-sm">Q</div>
       <div className="text-muted-foreground text-sm leading-relaxed pt-1">You are the administrator for a tenant with an Entra ID Free license. You need to create a group that automatically adds users based on their Department. What must you do first?</div>
    </div>
    <div className="flex gap-4">
       <div className="shrink-0 flex h-8 w-8 items-center justify-center rounded-none bg-green-500/10 text-green-500 font-bold text-sm">A</div>
       <div className="text-foreground font-medium text-sm leading-relaxed pt-1">Upgrade the tenant to <span className="text-primary">Microsoft Entra ID Premium P1</span> (or P2).</div>
    </div>
  </div>
</div>

## 2. Dynamic Membership Types

When configuring a group in Entra ID, you will encounter three membership types. For AZ-104, you must understand the difference between the two dynamic options:

<div className="grid gap-6 md:grid-cols-3 my-8 not-prose">

  <div className="rounded-none border bg-card text-card-foreground shadow-none flex flex-col">
    <div className="p-4 border-b bg-muted/30">
        <h3 className="font-bold text-base flex items-center gap-2 m-0 text-foreground">
            <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" className="lucide lucide-user-check"><path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><polyline points="16 11 18 13 22 9"/></svg>
            Assigned
        </h3>
    </div>
    <div className="p-4 flex flex-col flex-1 gap-4">
        <p className="text-sm text-muted-foreground m-0 leading-relaxed">You manually select users or devices to add to the group.</p>
        <div className="mt-auto rounded-none bg-secondary/50 p-3 text-xs font-medium text-secondary-foreground border border-secondary">
            <strong>Use Case:</strong><br/>Ad-hoc teams, temporary project groups (e.g., "Project Alpha Team").
        </div>
    </div>
  </div>


  <div className="rounded-none border border-blue-500/20 bg-blue-500/5 text-card-foreground shadow-none flex flex-col relative overflow-hidden ring-1 ring-blue-500/10">
    <div className="absolute top-0 right-0 p-2 opacity-[0.03]">
        <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100" viewBox="0 0 24 24" fill="currentColor"><path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/></svg>
    </div>
    <div className="p-4 border-b border-blue-500/10 bg-blue-500/10">
        <h3 className="font-bold text-base flex items-center gap-2 m-0 text-blue-600 dark:text-blue-400">
            <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" className="lucide lucide-users"><path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/></svg>
            Dynamic User
        </h3>
    </div>
    <div className="p-4 flex flex-col flex-1 gap-4">
        <p className="text-sm text-muted-foreground m-0 leading-relaxed">Users are added/removed automatically based on attributes.</p>
        <div className="bg-[#0d1117] text-gray-300 p-2 rounded border border-white/10 font-mono text-[10px] truncate">
            user.department -eq "Sales"
        </div>
        <div className="mt-auto rounded-none bg-blue-100 dark:bg-blue-900/30 p-3 text-xs font-medium text-blue-800 dark:text-blue-200 border border-blue-200 dark:border-blue-800/50">
            <strong>Use Case:</strong><br/>All employees in a specific department or location.
        </div>
    </div>
  </div>


  <div className="rounded-none border border-purple-500/20 bg-purple-500/5 text-card-foreground shadow-none flex flex-col relative overflow-hidden ring-1 ring-purple-500/10">
      <div className="absolute top-0 right-0 p-2 opacity-[0.03]">
        <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100" viewBox="0 0 24 24" fill="currentColor"><rect width="18" height="12" x="3" y="4" rx="2" ry="2"/><line x1="2" x2="22" y1="20" y2="20"/></svg>
    </div>
    <div className="p-4 border-b border-purple-500/10 bg-purple-500/10">
        <h3 className="font-bold text-base flex items-center gap-2 m-0 text-purple-600 dark:text-purple-400">
            <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" className="lucide lucide-laptop"><path d="M20 16V7a2 2 0 0 0-2-2H6a2 2 0 0 0-2 2v9m16 0H4m16 0 1.28 2.55a1 1 0 0 1-.9 1.45H3.62a1 1 0 0 1-.9-1.45L4 16"/></svg>
            Dynamic Device
        </h3>
    </div>
    <div className="p-4 flex flex-col flex-1 gap-4">
        <p className="text-sm text-muted-foreground m-0 leading-relaxed">Devices are added/removed automatically based on attributes.</p>
        <div className="bg-[#0d1117] text-gray-300 p-2 rounded border border-white/10 font-mono text-[10px] truncate">
            device.deviceOSType -eq "Windows"
        </div>
        <div className="mt-auto rounded-none bg-purple-100 dark:bg-purple-900/30 p-3 text-xs font-medium text-purple-800 dark:text-purple-200 border border-purple-200 dark:border-purple-800/50">
            <strong>Use Case:</strong><br/>Applying Intune policies to all Windows 10 machines.
        </div>
    </div>
  </div>
</div>

## 3. Creating the Rule (Lab 01 Context)

In the lab, you are often asked to create a group (e.g., `IT-Cloud-Admins`) that automatically includes anyone with the Job Title "Cloud Engineer".

### The Syntax
Entra ID uses a specific expression language for these rules.

*   **Simple Rule:**
    ```
    (user.jobTitle -eq "Cloud Engineer")
    ```

*   **Complex Rule:**
    ```
    (user.department -eq "IT") and (user.city -eq "Mississauga")
    ```

### Key Rules for the Exam:
1.  **Scope:** A dynamic group can contain **either** users **or** devices, generally not both in the same rule logic (though the scope is defined by the "Membership type" dropdown selected earlier).
2.  **Latency:** Membership updates are not instant. It can take minutes (or longer in large tenants) for the background process to evaluate the rule and update the group members.
3.  **Cannot Manually Add:** You cannot manually "Add Member" to a Dynamic Group. The *only* way to get in is to match the rule.

## 4. Summary Checklist for AZ-104

If you see a question about automating group membership, remember:

*   **License Check:** Do we have Premium P1/P2?
*   **Attribute Accuracy:** Does the user's attribute (e.g., `Department`) match the rule exactly? (Watch out for typos or case sensitivity in values).
*   **Automation:** This removes administrative overhead - users are automatically removed from the group if their attribute changes (e.g., they move from "Sales" to "HR").

---

## Related Endpoints & Navigation
- **All Articles**: [https://zainahmed.net/blog](https://zainahmed.net/blog)
- **Author Profile**: [https://zainahmed.net/about](https://zainahmed.net/about)
- **Machine-Readable LLM Manifest**: [https://zainahmed.net/llms.txt](https://zainahmed.net/llms.txt)
- **RSS Feed**: [https://zainahmed.net/feed.xml](https://zainahmed.net/feed.xml)