Not able to create Azure AD Dynamic Group

Viewed 10280

I am not able to create a dynamic AD group. The option to create a dynamic group is not available at all.

If I click to create a new group, the membership type is always 'Assigned' and the option is grayed out. Same thing happens if I try to change the assignment type of the existing group.

I am using a PAYG account and I am logged in as a Global Administrator.

3 Answers

Make sure you have at least Premium P1 licenses in Azure AD, as those are necessary to use this feature: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership

Note

This feature requires an Azure AD Premium P1 license for each unique user that is a member of one or more dynamic groups. You don't have to assign licenses to users for them to be members of dynamic groups, but you must have the minimum number of licenses in the tenant to cover all such users. For example, if you had a total of 1,000 unique users in all dynamic groups in your tenant, you would need at least 1,000 licenses for Azure AD Premium P1 to meet the license requirement. No license is required for devices that are members of a dynamic device group.

After assigning yourself the P1/P2 licence, need to sign out then sign back in for it take effect

A workaround, to save you the Azure AD Premier P1/P2 license, is to create dynamic groups in your local Active Directory and sync them to Azure using Azure AD Connect. You can then use the groups in both your on-prem AD and in Azure.

However, dynamic groups in AD are not natively available, you either need to program them yourself or use what others have created: I have made a free Windows service for this ("DynamicGroups") and also I see some people have created PowerShell scripts for this that are also free.

There are also paid-for applications out there to give your dynamic groups but you then need to compare pricing with the P1/P2 license and what other benefits you get from that.

Related