Skip to content

Added limitation clarity #1903

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Yebbenbe wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Added limitation clarity #1903

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion docs/identity/users/groups-dynamic-rule-member-of.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,9 +32,10 @@ You must be at least a [User Administrator](/entra/identity/role-based-access-co
- Each dynamic group can have up to 50 member groups.
- When you add members of security groups to `memberOf` dynamic membership groups, only direct members of the security group become members of the dynamic group.
- You can't use one `memberOf` dynamic group to define the membership of another `memberOf` dynamic group. For example, Dynamic Group A, with members of group B and C in it, can't be a member of Dynamic Group D.
- The `memberOf` attribute can't be used with other rules. For example, a rule that states dynamic group A should contain members of group B and also should contain only users located in Redmond will fail.
- The `memberOf` attribute can't be used with other rules. For example, a rule that states dynamic group A should contain members of group B and also should contain only users located in Redmond will fail.
Copy link

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Line has a trailing whitespace at the end of the sentence; please remove it to avoid markdown lint/formatting noise in future diffs.

Copilot uses AI. Check for mistakes.
- The dynamic group rule builder and validate feature can't be used for `memberOf` at this time.
- The `memberOf` attribute can't be used with other operators. For example, you can't create a rule that states "Members Of group A can't be in Dynamic group B."
- The operators given in the 'approved' preview query cannot be changed. That is, you cannot create a query for 'not members of X', via wrapping in -not or changing the existing operators (for example, the -in to -notIn)
Copy link

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This new limitation is hard to interpret because "approved preview query" isn’t defined elsewhere in the article, and the operators/examples aren’t formatted consistently. Consider rephrasing to remove the unexplained quoted term, use contractions consistent with the surrounding bullets ("can’t"), and format operators as code (for example, -not, -in, -notIn) with a clear example sentence ending in a period.

Copilot uses AI. Check for mistakes.
- Users included in `memberOf` dynamic membership groups may cause a slower processing time for your tenant, if the tenant has a large number of groups or frequent dynamic membership groups updates.
- Membership of a memberOf dynamic group doesn't automatically update when a child group is deleted or when members are removed from a child group. The affected users or devices remain members of the memberOf dynamic group until the rule is modified.

Expand Down