Unable to create Entra group

To create a Microsoft Entra dynamic group and avoid common creation issues, follow these steps and checks:

1. Verify licensing and permissions
   • Ensure the tenant has a Microsoft Entra ID P1 or P2 Premium license; dynamic groups require this license.
   • Confirm the account used to create the group has appropriate admin rights, such as Groups Administrator, User Administrator, or another role allowed to create groups.
   • Check that group creation for users is not restricted by a global admin:
     • In the Entra admin center, under Entra ID → Groups → General (Settings), verify that Users can create security groups in Azure portals and/or Users can create Office 365 groups in Azure portals are enabled if non-admins need to create groups.
     • If group creation is restricted to a specific set of users, ensure the account is in that allowed list.
2. Create the dynamic group in Microsoft Entra admin center
   1. Sign in to the Microsoft Entra admin center as at least a Groups Administrator.
   2. Go to Microsoft Entra ID → Groups → All groups.
   3. Select New group.
   4. Choose the Group type (for example, Security or Microsoft 365) and enter Group name and Group description.
   5. Set Membership type to Dynamic User or Dynamic Device.
   6. Select Add dynamic query.
   7. In the rule builder, add up to five expressions; if more are needed, switch to the text box and use an advanced rule.
   8. When the rule is complete, select Save, then on the New group page select Create.
   • If the rule is invalid, the portal will show an explanation; adjust the rule according to that message.
3. If the option to create a dynamic group is missing or fails
   • Confirm again that:
     • The tenant has Entra ID P1 or P2.
     • The account has permissions and is not blocked by tenant-wide group creation settings.
   • If using PowerShell and receiving a "max groups allowed" or similar error, check whether the tenant has reached the dynamic group limit:
     • Some documentation notes a maximum of 5,000–15,000 dynamic groups per tenant. If that limit is reached, delete existing dynamic groups before creating new ones; the limit cannot be increased.
4. If the dynamic membership rule cannot be created
   • Ensure the attributes used in the rule are supported:
     • For user attributes, verify they are in the list of supported properties.
     • For device attributes, verify they are in the list of device attributes.
   • If the attribute is not available in the simple rule dropdown, use Advanced Rule and ensure:
     • Syntax is correct.
     • Property type and value match.
     • The correct object prefix (user or device) is used.
5. Creating dynamic groups via PowerShell
   • Use New-EntraGroup to create a group, then configure dynamic membership as documented in Using attributes to create advanced rules.
   • Ensure the app or identity running the cmdlet has the required Graph permissions (for example, User.Read.All, Application.Read.All, or Directory.Read.All depending on owners/members being added).

If these checks are satisfied and the rule syntax is valid, dynamic group creation should succeed. If it still fails, capture the exact error message from the portal or PowerShell and compare it with the issues described in the dynamic group troubleshooting guidance.

References:

• Create or update a dynamic membership group in Microsoft Entra ID
• Manage Microsoft Entra groups and group membership
• Troubleshoot dynamic groups
• Troubleshoot and resolve groups issues
• New-EntraGroup