Fix dynamic groups whose rule processing failed

Contributed by Julien LyAll contributors →

Part of Maester · Entra ID · Groups · All checks

Run this check

Invoke-Maester -TestId MT.1265

Overview

Dynamic groups should not stay in a failed rule processing state.

When Microsoft Entra ID can’t evaluate the membership rule of a dynamic group, the group’s processing status becomes Processing error (Failed in Microsoft Graph). Until the error is fixed, the group’s membership does not follow its rule. In a lab test, a group in this state kept the members of its last successful evaluation and did not add a new user that its previous rule matched, while a control group that kept that rule added the user. Microsoft documents the same end state for groups that still use the memberOf operator after its preview ends on November 3, 2026: they stop updating and remain in their last known state. Conditional Access policies, group-based licensing and application access that target such a group keep applying to its old membership, and users who should have joined it are left out.

In the same test, a rule that referenced an unsupported property was refused while processing was on, but stored while processing was paused, in the portal and through Microsoft Graph. The error appeared only after processing resumed.

This test reads the processing status of every dynamic group whose processing is turned on and lists the groups whose status is Failed, with the error message, the Conditional Access policies that reference them and their rule. Paused groups have no processing status and are not evaluated.

Remediation action:

1. In the Microsoft Entra admin center, open Entra ID > Groups > All groups.
2. Open each reported group. Its overview page shows the processing status and an alert with the error.
3. Select Dynamic membership rules, correct the rule, and use Validate rules to check it against sample users or devices before you select Save.
4. Confirm that the processing status returns to Update complete and that the membership matches the rule.
5. Review the Conditional Access policies, license assignments and application access that use the group for users or devices that were left out or kept while processing failed.

Related links

• Check the processing status for a rule
• Validate rules for dynamic membership groups
• Understand and manage dynamic group processing
• Dynamic groups that use memberOf after the preview ends
• membershipRuleProcessingStatus resource type (beta)

Details

Every attribute of this check

Field	Value
Test ID	MT.1265
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Groups
Area	Identity lifecycle and hygiene
Resource type	Group
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
PowerShell test	Test-MtDynamicGroupProcessingFailure
Services	Graph

Source

• Test: tests/maester/entra/Test.MT.1265.ps1
• Documentation: tests/maester/entra/Test.MT.1265.md