What Does Dynamic device group Mean?
On This Page
Quick Definition
A Dynamic device group is a way to automatically organize devices in your network without doing it by hand. You write a rule, and the system adds or removes devices that match that rule. For example, you could create a group that always includes every Windows 11 laptop. When a new Windows 11 device joins, it goes into the group automatically.
Commonly Confused With
A Static device group requires you to manually add and remove members. Dynamic groups automate this with rules. Static groups are simpler but do not scale well. Use static only when membership rarely changes.
A group for the CEO’s personal devices is statically assigned because the membership is small and manually managed.
A Dynamic user group uses rules based on user attributes like department or job title. A Dynamic device group uses device attributes like OS version or compliance status. The rule syntax is similar but the prefix changes: user. vs device.
A Dynamic user group rule might be (user.department -eq “Sales”), while a Dynamic device group rule is (device.deviceOSType -eq “Windows”).
Nested groups can combine multiple static or dynamic groups, but dynamic membership does not automatically flow through nested groups. A device in a child dynamic group is not automatically a member of the parent group unless the parent has its own rule.
Group A is dynamic and contains all Windows 11 devices. Group B is also dynamic and contains all compliant devices. A device must be in both groups (A and B) separately; nesting does not combine membership.
Must Know for Exams
For the MD-102 (Microsoft 365 Endpoint Administrator) exam, Dynamic device groups are a core concept. The exam objectives explicitly include the ability to “configure device groups” and “manage device membership dynamically.” You should expect questions that test your understanding of when to use a Dynamic group versus a static (assigned) group. A common scenario is choosing the right group type to support an automatic enrollment scenario for new Windows devices.
The exam also tests your ability to write and troubleshoot Dynamic membership rules. You might be given a device attribute table and asked which rule will correctly include only devices that are Windows 11 Enterprise and compliant. The rule syntax matters. For example, the difference between using -eq and -startsWith can determine whether a device is included. Knowing that device.deviceOSVersion returns a string like “10.0.22621” and that -startsWith “10.0.226” would include that version while -eq “10.0.22621” would be more precise is the kind of detail you need.
Another high-frequency exam topic is Dynamic groups for Windows Autopilot. You will likely see a question about creating a Dynamic group that contains all devices imported into Autopilot. The rule uses device.devicePhysicalIds -any _ -contains “[ZTDId]”. You need to recall this exact syntax.
Exam questions may also present a scenario where an IT administrator creates a Dynamic group but the devices do not appear. The cause is often that the rule attributes do not match the device’s enrolled attributes, or that the device attributes have not been synchronized yet. Understanding that membership updates can take up to 24 hours by default, and that a manual refresh can expedite this, is important.
Finally, the MD-102 exam includes questions about managing Dynamic groups in the Microsoft Entra admin center. You should know that Dynamic groups can only be created for groups set to “Security” group type, not for “Microsoft 365” groups. This distinction is frequently tested.
Simple Meaning
Think of Dynamic device groups like a smart mailbox at your office. Instead of sorting each piece of mail yourself by reading every envelope, you set up rules with a label maker. One rule says: If the envelope has the word "Invoice" in the corner, drop it in the red tray. If it has "Personal" in the corner, drop it in the blue tray. You don’t have to check every letter because the system follows your rules.
In IT, a Dynamic device group works the same way. You create a rule that says something like: “Add any device that runs Windows 11 Pro and has more than 8GB of RAM.” Once this rule is saved, every time a device meets those conditions, Microsoft Entra ID automatically adds that device to the group. If the device’s operating system changes or it is upgraded, the rule checks again and might remove it. This means you never have to manually add or remove devices.
Why is this helpful? Many IT tasks require applying settings or apps to a specific set of devices. If you have to do it manually every time a new laptop is bought or a device is retired, it is easy to make mistakes. You might forget to add a device, or you might miss a computer that should have been removed. Dynamic groups do this work for you, so the device list is always accurate. They make sure the right devices get the right policies, applications, and updates without human error. That’s why IT professionals in organizations with Microsoft 365 use them every day.
Full Technical Definition
A Dynamic device group is a feature within Microsoft Entra ID (formerly Azure Active Directory) that automates device membership based on attribute-based rules. These rules are written as simple expressions that evaluate device attributes stored in the directory. When a device’s attributes change or a device is newly registered or joined, the membership engine re-evaluates the rule and adds or removes the device accordingly. This ensures that the group always reflects the current state of your device fleet.
Dynamic groups rely on a synchronization engine that runs periodically. When a device attribute changes, for example, the operating system version is updated from Windows 10 to Windows 11, or the device becomes compliant with a compliance policy, the engine recalculates membership for every dynamic group that references that attribute. The rule syntax uses a simple but powerful syntax similar to: (device.deviceOSVersion -startsWith "10.0.22000") for Windows 11, or (device.devicePhysicalIds -any _ -contains "[ZTDId]") for Windows Autopilot devices. Standard operators include -eq, -ne, -startsWith, -contains, -in, and logical operators like -and, -or, -not.
In practice, Dynamic device groups are used to target policies and applications without manual intervention. For example, you can create a group that includes all devices with a specific compliance status. When a device becomes non-compliant, it automatically leaves the group. This is critical for applying security settings only to devices that meet baseline requirements. Dynamic groups also support nested group membership if the nested groups are also dynamic, though there are important limitations, Microsoft Entra ID does not resolve transitive dynamic membership for deeply nested groups.
Behind the scenes, Microsoft Entra ID maintains a membership cache that is updated every few hours, though you can force a manual refresh. For exam MD-102, you need to know that Dynamic device groups are configured in the Microsoft Entra admin center under Groups, and that the rule builder provides a simple interface for constructing expressions. You should also understand that there is a limit of 5,000 dynamic groups per tenant, and that each dynamic group can have a rule of up to 15,000 characters. Misconfigurations in rule syntax are a common source of exam questions, especially when the rule uses an attribute that does not exist or uses the wrong operator.
Real-Life Example
Imagine you run a large library with thousands of books. Every week, new books arrive and old books are removed. Instead of a librarian walking through the shelves each day to check which books are new or old, you install a smart system at the door. This system reads the book’s barcode as it comes in. If the barcode says “Published after 2020,” the book is automatically placed on the “Modern Fiction” shelf. If the barcode says “Published before 1980,” the book goes to “Archives.” You don’t need a person to decide where each book goes, the rules do the sorting.
In IT, each device has attributes like operating system, compliance status, model, or department. A Dynamic device group acts like that smart library system. It reads the device’s attributes the moment the device is registered in Microsoft Entra ID. If the attribute matches a rule you wrote, the device is placed into the correct group automatically. If you look at a group called “Windows 11 Prod Devices,” the system has already decided which devices belong there. You never have to click “Add member.”
This is especially powerful when your organization has hundreds or thousands of devices. Manually grouping them would take hours and would be outdated days later. With Dynamic groups, the grouping is always current. If a device changes its operating system or moves to a different department, the group membership updates without any human action. The library never needs a librarian to sort books, and your IT team never needs to sort devices.
Why This Term Matters
Dynamic device groups matter because they eliminate one of the biggest sources of IT headaches: manual device management. In a typical organization, devices come and go frequently. New laptops are issued, old ones are retired, devices are re-imaged, and users change roles. If you rely on manual groups, you must remember to update membership every single time something changes. That is nearly impossible at scale, and mistakes lead to devices missing critical security updates or getting policies they should not have.
From a security perspective, Dynamic groups ensure that only compliant devices receive access to sensitive resources. For example, you can create a Dynamic group that includes only devices that are marked as compliant by Microsoft Intune. If a device falls out of compliance, it is automatically removed from the group, and any conditional access policy that targets the group will block that device. This automatic enforcement reduces the attack surface.
For automation and deployment, Dynamic groups are essential for Windows Autopilot. You can create a Dynamic rule that captures all Autopilot devices based on a specific ZTDId pattern. When a new device is registered in Autopilot, it appears in the group immediately, and Intune can push a deployment profile to it. Without Dynamic groups, you would have to manually assign each Autopilot device to a profile.
Operationally, Dynamic groups save time. IT administrators no longer need to run scripts or perform manual moves. They set the rule once and the system handles the rest. This frees up time for more strategic work. For exam MD-102, understanding Dynamic groups is crucial because they underpin many Intune and Microsoft Entra ID configurations, such as compliance policies, device configuration profiles, and application assignments.
How It Appears in Exam Questions
Dynamic device group questions on the MD-102 exam usually fall into three categories: scenario-based, configuration-based, and troubleshooting. In a scenario question, you might read: “Contoso wants all Windows 11 devices that are compliant to automatically receive a specific application. Which group type should you create?” The correct answer is a Dynamic device group with a rule that checks the operating system and compliance status. A distractor might suggest a static group or a nested group, but the scenario’s need for automatic updates points to Dynamic.
Configuration questions often present a rule and ask you to identify the outcome. For example: “You create a Dynamic group with the rule (device.deviceOSVersion -startsWith “10.0.22000”) -and (device.isCompliant -eq True). Which devices will be members?” You must know that -startsWith “10.0.22000” will match Windows 10 version 21H2 but not Windows 11 (which starts with 10.0.22621). So the rule would capture only that specific Windows 10 version.
Troubleshooting questions are common. A sample question: “You create a Dynamic device group but after 24 hours no devices appear. The devices are Windows 11 and compliant. What is the most likely cause?” Possible answers include: the rule uses an attribute that does not exist for those devices, the rule syntax is incorrect, or the group is a Microsoft 365 group (which cannot be dynamic). You need to carefully read the rule and verify attribute availability.
Another pattern is the “best practice” question. For instance: “You need to ensure that when a device becomes non-compliant, it is removed from a group used for policy targeting. What should you use?” The answer leverages Dynamic group with a compliance attribute, because Static groups would require manual removal.
Finally, expect at least one question on Autopilot Dynamic groups. The rule using device.devicePhysicalIds -any _ -contains “[ZTDId]” is a near-certain item. The exam will test whether you know that this rule captures all Autopilot devices automatically.
Study MD-102
Test your understanding with exam-style practice questions.
Example Scenario
Your company, Northwind Traders, has 500 devices running Windows 10 and Windows 11. The IT team is rolling out a new security app that must be installed only on Windows 11 devices that are compliant with company policies. You have been asked to automatically deploy this app to the right devices without manually selecting each one.
You decide to create a Dynamic device group. In the Microsoft Entra admin center, you create a new security group and set the membership type to “Dynamic Device.” You define a rule that says: (device.deviceOSVersion -startsWith “10.0.22621”) -and (device.isCompliant -eq True). This rule will include any device whose operating system version starts with 10.0.22621 (the version string for Windows 11) and that has the isCompliant attribute set to True.
Once saved, the membership engine processes all 500 devices. In a few minutes, the group shows 120 members. You then assign the security app to this group via Microsoft Intune. The next time each member device checks in, the app is installed automatically.
Two weeks later, one of the devices is found to have a missing antivirus signature, so Intune marks it as non-compliant. The Dynamic group rule re-evaluates, and the device is automatically removed from the group. When the device checks in again, the security app is removed because the assignment no longer targets the device. This ensures that only compliant Windows 11 devices keep the app, which reduces security risk. Without the Dynamic group, you would have to manually remove the device from the group or change the app assignment.
Common Mistakes
Creating a Dynamic group using device attributes that are not populated for those devices.
If the attribute does not exist or is null, the rule will not include the device, leading to an empty group.
Always verify that devices have the required attributes before writing the rule. Use the device’s properties page in Entra ID to confirm values.
Using the wrong operator, such as -eq instead of -startsWith when the attribute value includes a version string.
If you use -eq with a precise version, devices with slightly different build numbers will not match. This excludes valid devices.
Use -startsWith or -contains when matching version strings or partial values. Only use -eq when you need an exact match.
Setting the group type to “Microsoft 365” instead of “Security” when creating a Dynamic device group.
Dynamic device membership is only supported for Security groups, not for Microsoft 365 groups.
In the group creation wizard, choose “Security” as the group type. Microsoft 365 groups are for collaboration, not device targeting.
Assuming that Dynamic group membership updates instantly across all scenarios.
Membership re-evaluation can take up to 24 hours normally, and even a manual refresh does not happen instantly for every change.
Plan for a delay. Use the “Refresh” option in the group overview to expedite, but know that full processing may still take minutes.
Exam Trap — Don't Get Fooled
{"trap":"The exam asks you to create a Dynamic group for Autopilot devices but uses a rule with -eq instead of -contains, or uses a different attribute like “device.deviceCategory”.","why_learners_choose_it":"Learners may not memorize the exact Autopilot attribute and guess a more general attribute like deviceCategory, or they may assume that an exact match with -eq is correct."
,"how_to_avoid_it":"Memorize the specific attribute: device.devicePhysicalIds -any _ -contains “[ZTDId]”. Know that -any is required because devicePhysicalIds is an array, and -contains checks if any element matches.
Never use -eq with an array, and never use a different attribute for Autopilot."
Step-by-Step Breakdown
Determine the attribute to use
Identify which device attribute best categorizes your devices. Common attributes include device.deviceOSVersion, device.isCompliant, device.deviceCategory, and device.devicePhysicalIds. The attribute must be populated for the devices you want to include.
Write the membership rule
In the Microsoft Entra admin center, navigate to Groups and create a new Security group. Set Membership type to “Dynamic Device.” Use the rule builder or write a custom expression. For example: (device.deviceOSVersion -startsWith “10.0.22621”).
Test the rule before saving
Use the “Validate Rules” feature to test your rule against a few example devices. This prevents errors that lead to empty groups. The validation shows which sample devices would be included or excluded.
Save the group and monitor membership
Once saved, the membership engine begins processing. You can see the member count update over minutes or hours. If no devices appear, check the rule syntax and confirm that devices have the attributes you used.
Use the group in policies or app assignments
Go to Microsoft Intune and assign a configuration profile or application to this group. Because the group is dynamic, policies apply automatically as devices enter or leave the group.
Periodically review and adjust the rule
As your environment evolves, you may need to update the rule. For example, when Windows 12 releases, you may need to add a rule to include its version string. Dynamic groups can have multiple conditions using -and or -or.
Practical Mini-Lesson
In practice, Dynamic device groups are a fundamental building block for endpoint management with Microsoft Intune. As an IT professional, you will use them to scope nearly every policy you deploy. The key is to design your group strategy before creating any rules. Start by listing the categories of devices you need: for example, “All Windows 11 workstation devices,” “All compliant devices,” “All Autopilot devices,” and “All kiosk devices.” Then, identify the unique attribute that defines each category.
For Windows 11, use the version string: 10.0.22621 is Windows 11 version 22H2, and 10.0.22631 is version 23H2. A rule that uses -startsWith “10.0.226” would capture both versions, which is often what you want. For Windows 10, the version string starts with 10.0.19041, 10.0.19042, etc., so you would use -startsWith “10.0.19” to include all Windows 10 devices.
Compliance is tracked by the device.isCompliant attribute, which is set by Microsoft Intune compliance policies. A device that fails compliance becomes isCompliant = False. If you create a Dynamic group that requires isCompliant = True, that device is automatically dropped from the group. This is used heavily for conditional access policies: only devices in the “Compliant devices” group can access email in Outlook.
What can go wrong? The most common issue is that the attribute you think is populated is actually empty for some devices. For example, device.deviceCategory is not automatically set; it requires an administrator to assign a category or a rule to populate it. If you create a Dynamic group based on deviceCategory and no devices have that attribute, your group will be empty. Always validate with sample devices before saving.
Another issue is the 24-hour refresh cycle. If you change a device’s operating system (like upgrading from Windows 10 to Windows 11), it can take up to a day for the Dynamic group to reflect the change. For time-sensitive scenarios, you can manually trigger a membership refresh in the group’s overview page.
Finally, remember that Dynamic groups only work with devices that are registered in Microsoft Entra ID. On-premises Active Directory devices that are not hybrid joined will not appear. You must ensure devices are either Azure AD joined or hybrid Azure AD joined.
Memory Tip
Think “D.A.R.”: Dynamic groups use Device Attributes in Rules.
Covered in These Exams
Current Exam Context
Current exam versions that test this topic — use these objectives when studying.
Related Glossary Terms
Two-factor authentication (2FA) is a security method that requires two different types of proof before granting access to an account or system.
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
AAA (Authentication, Authorization, and Accounting) is a security framework that controls who can access a network, what they are allowed to do, and tracks what they did.
An A record is a type of DNS resource record that maps a domain name to an IPv4 address.
Frequently Asked Questions
Can I convert a Static group to a Dynamic group?
No, you cannot change the membership type of an existing group. You must create a new Dynamic group and copy any existing members manually or through a migration script.
How long does it take for a Dynamic group to update after a device attribute changes?
By default, membership re-evaluation can take up to 24 hours. You can manually trigger a refresh from the group overview, but full processing still takes minutes. Some changes like device registration can appear in minutes.
Can I use Dynamic groups with on-premises devices?
Only if those devices are hybrid Azure AD joined and their attributes are synchronized to Microsoft Entra ID. Purely on-premises devices not synced cannot be evaluated.
What happens if my Dynamic rule contains an attribute that doesn’t exist?
The rule will simply not match any devices that lack that attribute. The group will be empty or include only devices that have the attribute with a matching value. The rule itself is saved without error.
Are there limits on the number of Dynamic groups I can create?
Yes. In Microsoft Entra ID, you can have up to 5,000 Dynamic groups per tenant. Each rule can be up to 15,000 characters.
Can I use Dynamic groups for user groups as well?
Yes. Dynamic groups can be either Dynamic Device groups or Dynamic User groups. The rule syntax is similar, but device groups use the device. prefix and user groups use the user. prefix.
Summary
Dynamic device groups are a core feature of Microsoft Entra ID that automates device grouping using attribute-based rules. Instead of manually adding and removing devices from groups, you write a simple expression that evaluates device attributes like operating system version, compliance status, or Autopilot registration. The system adds any device that matches the rule and removes any that no longer meet the condition. This automation is essential for managing device fleets at scale, ensuring that policies and applications are always applied to the correct set of devices without human intervention.
For IT professionals preparing for the MD-102 exam, understanding Dynamic device groups is not optional. The exam tests your ability to choose between Dynamic and Static groups, write correct membership rules, and troubleshoot common issues like empty groups or incorrect attribute usage. You should be comfortable with the rule syntax, the specific attributes used for Autopilot, and the refresh timing.
The key takeaway is that Dynamic groups reduce administrative overhead and improve accuracy. They allow organizations to enforce security and compliance automatically. Whether you are deploying Windows 11, managing conditional access, or rolling out applications, Dynamic device groups are the foundation of a modern endpoint management strategy. Focus on memorizing the Autopilot rule, understanding version string matching, and knowing when to use Dynamic versus Static groups.