A dynamic group computes its membership from a rule over user or device attributes, such as department or employee type, instead of administrators adding members by hand. Membership updates automatically as attributes change.
Assigned versus dynamic#
Assigned groups are curated: someone decides each membership. Dynamic groups are declarative: the rule decides, continuously. That trade buys freshness at the cost of a new failure mode, because a wrong attribute now silently grants or removes access and licenses.
Dynamic membership also changes how structure should be read: the effective question stops being who was added and becomes which attribute values satisfy the rule, which is invisible in a member list.
Interaction with licensing and governance#
Assigning licenses to dynamic groups is powerful and sharp edged: an attribute sync error can churn licensing at scale. Many organizations therefore write governance rules about where dynamic groups may appear in the hierarchy and whether they may carry license assignments.
VisualizerEngine
Dynamic groups in VisualizerEngine
Dynamic groups appear in the hierarchy alongside assigned ones, and the policy engine encodes structural constraints from templates or from scratch, scoring violations into a live compliance percentage. Snapshots and diffs show membership churn over time, which is where attribute-driven surprises reveal themselves.