Lab — Watch a dynamic group fill itself in
AZ-104 › Unit 1 › Lab
Lab — Watch a dynamic group fill itself in
Lab brief
- AZ104-U1.T1
- 20 minutes
- Directory users and groups
- required
- Core
The claim to make physical: membership type is decided once. A group that can carry Entra roles is forced to Assigned and can never become dynamic — and you find that out by trying it, not by reading it.
Before you start
An Azure subscription and the Groups Administrator or User Administrator role, which is what creating groups requires. Sign in with az login first. Directory objects are not billable resources.
Walkthrough
Watch a dynamic group fill itself in
1. Create two users with different departments
Create two users with az ad user create (it requires --display-name, --password and --user-principal-name). ⚠ It has no --department parameter, and neither does az ad user update — the CLI cannot write that attribute at all. Set one user's department to Engineering and the other's to Finance in the Entra admin center, or through Graph: az rest --method PATCH --url https://graph.microsoft.com/v1.0/users/OBJECT-ID --headers Content-Type=application/json --body '{"department":"Engineering"}'. Note the object ids; you will want them in step 4.
Did it teach you what it was meant to?
You watched a user join a group in step 4 without anybody adding them, then watched the portal refuse to change membership type in step 5. Which requirement can a role-assignable group NOT satisfy?
Your tenant has 40 Microsoft Entra ID P1 licences and 250 users would match your dynamic rule. What does the documentation require?
What goes wrong
Tear it down
Run this whether or not the lab worked. Everything above was chosen to cost approximately nothing, and leaving it in place is how approximately nothing becomes something.
Teardown
Delete the three groups, then the two users
Use az ad group delete for each group and az ad user delete for each user. Directory objects cost nothing, but leaving test principals in a directory is how a stale account outlives the person who made it.
Where these figures come from
Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.
| Document | sha1 |
|---|---|
| Manage Microsoft Entra groups and group membership | 5e94c543e4b9 |
| Dynamic membership rules for groups | c7bcd79f770a |