Microsoft Entra ID

Manage rules for dynamic membership groups in Microsoft Entra ID

14 August 2026Updated+6 / −2 lines

In brief

The article now explains that agent user accounts are evaluated by user-based membership rules and can join dynamic user groups. By default, they are not distinguished from other user identities; rules can explicitly exclude or include them, including accounts tied to a specific agent identity blueprint.

What Entra admins need to know

Review dynamic group membership rules if agent accounts should be excluded or targeted. The documentation metadata date changed to 08/13/2026.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

This article details the properties and syntax to create rules for dynamic membership groups based on users or devices.

An agent's user account is a subtype of user identity within Microsoft Entra. An agent's user account is evaluated by user-based membership rules and can be included in a dynamic user group when it satisfies the rule.

By default, an agent's user account isn't distinguished from other user identities. To exclude these accounts, include a condition in the membership rule. You can also create rules that include only agents' user accounts or target accounts associated with a specific agent identity blueprint. Agent identities, which are service principals, aren't supported as members of dynamic membership groups.

@@ -2,8 +2,8 @@ title: Manage rules for dynamic membership groups in Microsoft Entra ID description: Learn how to manage rules for dynamic membership groups to automatically populate group members and rule references. ms.topic: how-to-ms.date: 03/05/2026-ms.reviewer: yukarppa+ms.date: 08/13/2026+ms.reviewer: mbhargav ms.custom: it-pro ai-usage: ai-assisted ---@@ -17,6 +17,10 @@ You can create user-based or device attribute-based rules to enable membership f  This article details the properties and syntax to create rules for dynamic membership groups based on users or devices. +An agent's user account is a subtype of user identity within Microsoft Entra. An agent's user account is evaluated by user-based membership rules and can be included in a dynamic user group when it satisfies the rule.++By default, an agent's user account isn't distinguished from other user identities. To exclude these accounts, include a condition in the membership rule. You can also create rules that include only agents' user accounts or target accounts associated with a specific agent identity blueprint. Agent identities, which are service principals, aren't supported as members of dynamic membership groups.+ > [!NOTE] > Security groups can include either devices or users, but Microsoft 365 groups can include only users.