Synchronize M365 and other cloud groups flexibly
with each other – a feature that Microsoft itself doesn’t provide.
With up to 50 nested filters, define dynamic memberships
more precisely than ever – no Entra P1 license required.
As a pure cloud service, DynamicSync specializes in
dynamic group synchronization in the cloud.
Examples of synchronizations:
DynamicSync filters the appropriate members according to selected
Entra ID attributes and assigns them to a target group.
Advantages of dynamic filters:
With DynamicSync, Microsoft Entra groups of different types are synchronized to other Entra groups.
All source groups are available for this purpose:
The synchronized groups are saved as M365 or security groups.
DynamicSync enables the automatic assignment of selected employees to Entra ID groups using dynamic filters.
👉 All standard attributes, including extension attributes, can be selected. In addition, schema-extended attributes can be added.
Users who have a specific attribute in common (e.g., department) are filtered out and assigned to a suitable group.
Group synchronization takes place automatically at regular intervals (four times an hour). This ensures that all groups and members are always up to date.
If necessary, synchronization can also be started or paused manually.
In addition, a status message provides assurance that synchronization has been completed successfully.
The advanced filter options in DynamicSync allow members of a source group to be precisely assigned to a target group using multiple nested filters.
👉 DynamicSync allows up to 50 filter queries.
The nested filter pulls all users in Entra ID that match the attribute values into a common target group. With Entra’s built-in tools, a maximum of 5 filters can be added linearly.
For special user-friendliness, the operators (query parameters) in the filter query adapt to the selected user property.
If certain users or groups should not have access to sensitive data or certain functions, DynamicSync provides include and exclude lists for this purpose.
The exclusion lists remain in place during synchronization, so no manual changes are necessary.
In the member preview, you can see all members of the group. This makes it easy to check whether the filter rules have been applied correctly.
If a group is configured as a “dynamic group” in Entra ID, membership is determined exclusively by defined rules (e.g., based on attributes such as department, location, job title, etc.).
This means:
👉 With DynamicSync, team owners can add members in parallel, even if the M365 group is dynamic.
With DynamicSync, you can transfer Active Directory groups directly to Microsoft Teams – including permissions
and configurations. The synchronization automatically transfers important settings such as:
This significantly reduces the workload for administrators:
Permissions and group structures are maintained centrally in Active Directory
and then easily synchronized to the cloud.
DynamicSync is the ideal solution for:
Get to know DynamicSync in a free online demo – our team will be happy to answer all your questions.
In Entra ID, it is not possible to set the membership type to “dynamic” if a role permission is attached to the group.
👉 With DynamicSync, however, it is possible to make the management of Entra roles dynamic.
This allows users from a specific department to automatically be assigned the reader role, for example, to view a landing zone for a subscription.
In addition to the “admin role,” DynamicSync offers two additional roles: ‘contributor’ and “reader.” These additional roles allow restricted access to DynamicSync for other user groups.
© 2025 · FirstAttribute AG.
