How to list dynamic groups in Microsoft Entra ID

Before you start

Use an account with a role that can read groups, such as Directory Readers or Groups Administrator. The PowerShell example requests GroupMember.Read.All; your organisation may require administrator consent.

Know what a dynamic group is. Its rule tests user properties, such as user.department, or device properties, never both, and Entra ID adds and removes members as those properties change. Microsoft 365 groups can hold only users; security groups can hold users or devices. Each user in a dynamic group needs Microsoft Entra ID P1; devices need no licence. The examples read and export; they don't change a rule or pause processing.

Option 1

List dynamic groups with PowerShell

Install the modules once, then connect and export every dynamic group. The filter runs in Microsoft Graph, so only dynamic groups come back.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Groups -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'GroupMember.Read.All' -NoWelcome
try {
    $filter = "groupTypes/any(s:s eq 'DynamicMembership')"
    $properties = 'id', 'displayName', 'groupTypes', 'membershipRule',
        'membershipRuleProcessingState', 'createdDateTime'
    $groups = @(Get-MgGroup -All -Filter $filter -Property $properties)
    $report = @(foreach ($group in ($groups | Sort-Object DisplayName)) {
        $type = 'Security'
        if ($group.GroupTypes -contains 'Unified') { $type = 'Microsoft 365' }
        [pscustomobject]@{
            Group        = $group.DisplayName
            Type         = $type
            Processing   = $group.MembershipRuleProcessingState
            UsesMemberOf = $group.MembershipRule -match 'memberOf'
            Rule         = $group.MembershipRule
            Created      = $group.CreatedDateTime
            Id           = $group.Id
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'The tenant has no dynamic groups.'
    } else {
        $report | Export-Csv -Path './dynamic-groups.csv' -NoTypeInformation -Encoding utf8
        $paused = @($report | Where-Object { $_.Processing -eq 'Paused' }).Count
        Write-Output "$($report.Count) dynamic groups; processing is paused for $paused."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

Processing is On or Paused; a paused group keeps its members and stops updating. UsesMemberOf marks rules that use the memberOf operator, whose preview has ended. Remove the filter to list every group and compare.

Check 1 dynamic group

Reconnect with Connect-MgGraph, then read 1 group's rule and count its members.

# Run while connected to Microsoft Graph. Replace the example group name.
$group = @(Get-MgGroup -Filter "displayName eq 'Contoso Sales'" `
    -Property id, displayName, membershipRule, membershipRuleProcessingState)
if ($group.Count -ne 1) { throw "Found $($group.Count) groups with that name; use its ID." }
$count = Get-MgGroupMemberCount -GroupId $group[0].Id -ConsistencyLevel eventual
$group[0] | Select-Object DisplayName, MembershipRule, MembershipRuleProcessingState
Write-Output "$count direct members."

Option 2

Check a dynamic group in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > Groups > All groups, then search for the group and select it.
3. On its Overview page, read the membership type, the Dynamic rule processing status, such as Update complete or Processing error, and the Last membership change.
4. Select Dynamic membership rules to read the rule. Close it without saving, and leave Pause processing alone.

This suits checking a group whose members look wrong. The admin centre shows a rule 1 group at a time, so to see every dynamic group and its rule together, use PowerShell or a report.

Common questions

Why has a dynamic group stopped updating?

Check its processing status first: it may be paused, or show a processing error from its rule. The preview of the memberOf operator has ended: after 3 November 2026, groups whose rule uses it stopped updating and keep their last members, so replace those rules.

How long does a change take to show?

Usually a few minutes in a small directory and 30 minutes or longer in a large one. After a new rule or a rule change, a group can take up to 24 hours to fill.

Why is a dynamic group empty?

Its rule matches no one at the moment, so read the rule and the property values it tests. To find every group with no members, see how to find empty groups.