// tools/dynamic-groups

Dynamic group rule tester

Paste a dynamic membership rule and some users or devices. The tool checks the syntax, explains the rule in plain English, and shows who would be in the group and why, before you save anything in Entra.

Runs entirely in your browser. Nothing you paste is sent anywhere.

Membership rule

Users or devices to test (JSON or CSV)

load file

Get some test users

powershell5 lines

1
2
3
4
5Connect-MgGraph -Scopes User.Read.All
Get-MgUser -Top 200 -Property displayName,userPrincipalName,department,jobTitle,country,usageLocation,userType,accountEnabled,companyName,employeeId,city,proxyAddresses,onPremisesExtensionAttributes |
  Select-Object displayName,userPrincipalName,department,jobTitle,country,usageLocation,userType,accountEnabled,companyName,employeeId,city,proxyAddresses,
    @{n='extensionAttribute1';e={$_.OnPremisesExtensionAttributes.ExtensionAttribute1}} |
  ConvertTo-Json -Depth 4 | Out-File users.json

Good to know

String and regex comparisons aren't case sensitive, but property names are. user.Department won't work.
Precedence from highest to lowest: comparisons, -not, -and, -or, then -any and -all. Use brackets to make your intent clear.
Microsoft recommends using -match and -contains as little as possible, because they make rules slower to process.
Use -eq null or -ne null to test for empty values. Rules can be up to 3,072 characters.
Check who can change an attribute before you base access on it. Some attributes synced from Active Directory can be edited by users themselves.

Sources