The purpose of a dynamic group in Azure AD is to be one based on a query. This means the membership of this group is then constructed on the successful matching of that query. The use case I’m going to build here is a dynamic Azure AD group that will contain devices that I wish to retire from an Azure AD.
To use dynamic groups in your environment you are going to need to be licensed for Azure AD P1 or P2. Thankfully, if you are using Microsoft 365 Business Premium, you’ll have Azure AD P1.
The way that the machines to be retired will be identified is by their unique Device ID as it appears in Azure AD. Thus, first stop will be the Azure AD portal to record these unique Device Ids.
Navigate to the Azure AD portal as an administrator (https://aad.portal.azure.com) and select the Devices item on the left hand side as shown above to see all the devices your Azure AD knows about.
In the page that appears, select All devices on the left and then search for the device(s) you wish using the search box on the right as shown above. Here, I’m searching for the device called VPC02. Select the device name to get more information about that device.
On the details page for the device you should now find the unique Device ID, as shown above. You should take a copy of this as it will be needed later.
Repeat the above process to obtain the unique Device ID of all the devices in Azure AD you wish to retire.
Return to Azure AD portal home page and now select Groups from the menu on the left.
Select the option on the top right for a New group.
Set the group type to Security. Give the group a meaningful name (here To be retired) as well as a description. Finally, ensure that the Membership type is set to Dynamic Device, because in this case we want to query a list a devices in Azure AD.
At the bottom of the options, select the Add dynamic query hyperlink as shown above.
On this page you will build the dynamic query for the membership of the group. Here we want to query the deviceid property to see whether it equals the Device Id we obtained initially for the device(s) we wish to retire.
Each unique device will generally require its own unique query line with the And/Or set to Or for this use case.
Once you add the entries at the top of the page you’ll see the actual rule syntax displayed in the box below, as shown.
To test the query returns the expected results, select the Validate Rules (Preview) option at the top of the page as shown. Next, Add devices you wish to test the query with. In the case above, I selected a machine I knew should match (VPC02) and one that wouldn’t (WIN10ENT). These selections will be validated and results displayed.
Here, the validation returns the expected results for this use case, so I can select the Save button at the top of the page to continue.
In the list of Azure AD groups, you should now be able to see the one that you just created.
.
If you now select this new group you will probably find that it doesn’t have any members as yet as seen above.
Fear not. Because the group is dynamic, it will take a few moments to run the query you created and populate it with matching members. When it has done this after a short time, you will be able to find the results in the Members option on the left hand side as shown above. Check that they match the expected results.
At that point, the Overview page should also display the correct count of members as shown above.
You can of course edit this Azure AD Dynamic Group at any point and change the membership criteria. In the case of retired devices, we’ll need to go in again and add any new Device Id’s for devices we want retired from our environment down the track.
A dynamic group can be based on just about any criteria and you may use it to identify new devices, users in the marketing department and so on. The queries can also be quite complex and it is recommended you consult this documentation from Microsoft for more information:
Dynamic membership rules for groups in Azure AD
In this case, we can now use this dynamic group of old devices to off board them cleanly from our Microsoft 365 environment. Stay tuned for upcoming articles on how to do this.
CIAOPS 
One thought on “Create a dynamic group in Azure AD”