A circular group reference is a membership loop: a chain of nested groups in which following the member-of relationships eventually returns to the starting group. Loops make effective membership ambiguous and are a known cause of provisioning failures.
Why loops are harmful#
Systems that expand group membership recursively must either detect loops or run forever, and different consumers of the directory handle that differently. Provisioning connectors, sync tools, and custom scripts have all been broken by an unexpected cycle in membership data.
Beyond tooling, loops corrupt human reasoning: in a loop, every group is simultaneously above and below every other, so questions like which group is the parent stop having answers.
How loops are detected#
Loop detection is cycle detection on the membership graph: walk group-to-group edges depth-first and flag any path that revisits a group. The detection itself is standard; the operational work is keeping it running continuously and presenting the loop with enough context to choose which edge to remove.
VisualizerEngine
Circular references in VisualizerEngine
Detection runs continuously against the mirrored directory and surfaces loops before they break provisioning, drawn on the graph with everything else that flows through each edge. What-if simulation previews cutting an edge, so the loop is resolved with the full consequence list visible.