Lab — Watch a dynamic group fill itself in
AZ-104 › Unit 1 › Lab
Lab — Watch a dynamic group fill itself in
Lab brief
- AZ104-U1.T1
- 20 minutes
- Directory users and groups
- required
- Core
The claim to make physical: membership type is decided once. A group that can carry Entra roles is forced to Assigned and can never become dynamic — and you find that out by trying it, not by reading it.
Before you start
An Azure subscription and the Groups Administrator or User Administrator role, which is what creating groups requires. Sign in with az login first. Directory objects are not billable resources.
Walkthrough
Watch a dynamic group fill itself in
1. Create two users with different departments
Use az ad user create twice, giving one user a department of Engineering and the other Finance. Note the object ids it returns; you will want them in step 4.
Did it teach you what it was meant to?
You watched a user join a group in step 4 without anybody adding them, then watched the portal refuse to change membership type in step 5. Which requirement can a role-assignable group NOT satisfy?
Your tenant has 40 Microsoft Entra ID P1 licences and 250 users would match your dynamic rule. What does the documentation require?
What goes wrong
Tear it down
Run this whether or not the lab worked. Everything above was chosen to cost approximately nothing, and leaving it in place is how approximately nothing becomes something.
Teardown
Delete the three groups, then the two users
Use az ad group delete for each group and az ad user delete for each user. Directory objects cost nothing, but leaving test principals in a directory is how a stale account outlives the person who made it.
Where these figures come from
Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.
| Document | sha1 |
|---|---|
| Manage Microsoft Entra groups and group membership | 5e94c543e4b9 |
| Dynamic membership rules for groups | c7bcd79f770a |