Your path to a cloud career starts here

Overview

Every Azure subscription trusts a Microsoft Entra tenant to say who someone is. Two objects in that tenant do most of the day-to-day work: users (identities for people) and groups (collections of identities). Creating users gives people a sign-in. Creating groups lets you grant access to many of them in one step.

The problem groups solve is repetition. Without them, each permission is handed out person by person. With them, a resource owner or directory owner assigns a set of access permissions to every member of the group, instead of providing the rights one-by-one. Adding or removing one person then grants or revokes access with minimal effort.

Entra ID can also fill groups for you. It supports defining membership based on rules, such as the department a user works in or their job title.

Core concepts

User. An identity in the tenant. Cloud users are created in the Microsoft Entra admin center under the Users area, where you supply details such as a user principal name and display name. The user can then be placed in groups.

Group. A container that organizes users so permissions are easier to manage. Entra ID has two group types.

Security group. The most common type, used to manage access to shared resources. Its members can be users, devices, and service principals. Example: a group called "Finance-Readers" that is given read access to a storage account, so every member gets that access at once. Creating this type requires a Microsoft Entra administrator.

Microsoft 365 group. A collaboration group. Members get a shared mailbox, calendar, files, a SharePoint site, and more. It can also give people outside the organization access, and it is available to both users and admins. Example: a project team that needs a shared mailbox and document library.

Membership type. The second characteristic of a group, which controls how members are added. There are three values:

• Assigned - members are added and maintained manually.
• Dynamic User - users are added and removed automatically based on rules over user attributes such as department, job title, or location.
• Dynamic Device - the same idea for devices. It applies to security groups only, because Microsoft 365 groups support dynamic users but not dynamic devices.

Dynamic rule. The expression that decides membership. Example: all users whose Department attribute equals "Marketing" go into a Marketing security group.

How it works

1. Open the Groups item under Identity in the Microsoft Entra admin center to see existing groups. A brand-new deployment has none, so the list starts empty.

2. Create the group and choose its type: Security or Microsoft 365.
3. Choose the membership type: Assigned, Dynamic User, or Dynamic Device.
4. For an assigned group, add members by hand. For a dynamic group, build a rule with the membership rule generator, for example one that includes members from a specific place.

5. After that, Entra ID keeps membership current. When a member's attributes change, such as a move to another department, all dynamic membership rules in the tenant are reevaluated, and the user is added to or removed from groups accordingly.

Dynamic membership requires a Microsoft Entra ID P1 license, or Intune for Education for device-based rules.

Comparison

Aspect	Security group	Microsoft 365 group
Purpose	Manage access to shared resources	Collaboration: mailbox, calendar, files, SharePoint
Members	Users, devices, service principals	Users (dynamic users supported)
Who can create	Requires an Entra administrator	Users and admins
Dynamic Device	Supported	Not supported
Outside people	Not described in the source	Can be given access

Scenario

A company hires ten sales staff. The administrator wants them to reach a shared sales storage account without assigning rights ten times. They create a security group named "Sales-Staff" (a security group, since the goal is resource access, and an administrator is needed to create it). Because each new user has Department set to "Sales", they choose Dynamic User membership and write a rule on the Department attribute. This needs a Microsoft Entra ID P1 license. The permission is granted once to the group. When a sales employee moves to Marketing, the rules are reevaluated and the person leaves the group automatically.

Exam traps

• Dynamic Device membership is for security groups only. A Microsoft 365 group cannot use it.
• Dynamic membership needs Microsoft Entra ID P1. A free tenant cannot use rules.
• A security group needs a Microsoft Entra administrator to create it, while the Microsoft 365 option is open to users and admins.
• Only Microsoft 365 groups come with a shared mailbox, calendar, and SharePoint site. Security groups are for access control.
• Group type (Security or Microsoft 365) and membership type (Assigned, Dynamic User, Dynamic Device) are separate settings.
• Members of a dynamic group are managed by the rule. Adding people by hand is the Assigned model.