Why Active Directory Groups Don't Automatically Update Microsoft Teams Membership (And What to Use Instead)

One of the more common requests in Microsoft Teams administration is: "Can we automatically manage Team membership bas...

One of the more common requests in Microsoft Teams administration is:

"Can we automatically manage Team membership based on organisational data such as cost centre, business unit, location, or department?"

Many organisations initially attempt this using traditional Active Directory (AD) security groups synchronised from on-premises environments to Microsoft Entra ID (formerly Azure AD). On the surface, this seems logical—maintain a group in Active Directory and let Teams inherit the membership.

Unfortunately, this approach often leads to disappointment.

The Traditional AD Group Approach

Historically, organisations have used Active Directory security groups to manage access to systems and resources. With Microsoft Entra Connect, these groups can be synchronised to the cloud and become visible in Microsoft 365.

The expected workflow is usually:

• ► Create an Active Directory security group
• ► Synchronise it to Entra ID
• ► Add the group to a Microsoft Team
• ► Allow membership changes in AD to automatically flow into Teams

While this seems reasonable, it is not how Teams behaves.

What Actually Happens:

When a security group is added to a Microsoft Team, Teams typically performs a one-time expansion of that group's membership.

In other words:

• ► The current users within the group are added to the Team
• ► The Team receives those users as individual members
• ► Teams does not continue monitoring the source security group for future changes
• ► The result is that the Team quickly becomes disconnected from the group that originally populated it

Common Symptoms:

Administrators usually discover the issue when:

• ► New staff added to the AD group do not appear in the Team.
• ► Staff who transfer to another area remain Team members.
• ► Leavers continue to retain access until manually removed.
• ► Team owners spend increasing amounts of time managing membership manually.

From a governance and security perspective, this can create ongoing challenges, particularly in large organisations where staff movement is frequent.

Why Dynamic Entra Groups Are Different

Microsoft's modern approach is based on dynamic membership within Microsoft Entra ID.

Rather than maintaining static lists of users, membership is determined automatically using attributes stored against user accounts.

For example:

Cost Centre = 12345678

or

Department = ICT

or

Office Location = Darwin

Instead of an administrator manually adding and removing users, Entra evaluates membership rules and keeps the group current automatically. How Dynamic Membership Works Imagine a rule such as:

user.extensionAttribute15 -eq "12345678"

Whenever a user's attribute matches the rule: They are automatically added to the group. When the attribute no longer matches: They are automatically removed. No manual intervention is required. The membership becomes driven by authoritative data rather than human administration. The Microsoft-Supported Design Microsoft's recommended architecture is:

Microsoft 365 Group
           ↓
Dynamic Membership Rule
           ↓
Microsoft Team

In practice:

• ► Create a Microsoft 365 Group
• ► Configure its membership type as Dynamic User
• ► Create a Team using that group
• ► Now the Team's membership remains aligned with the dynamic group

What This Achieves 

When configured correctly:

Event	Outcome
New starter joins the organisation	Added automatically once attributes are populated
Employee transfers into the business unit	Added automatically
Employee transfers elsewhere	Removed automatically
Employee leaves the organisation	Removed automatically
Cost centre changes	Membership updates automatically

  This provides a much more sustainable approach than manually maintaining Team membership.

Handling Real-World Exceptions

Business structures are rarely perfect. Sometimes contractors, acting staff, shared accounts, or specialist roles need access even though they do not meet the primary membership rule. This is where dynamic groups become particularly powerful. 

A rule might effectively operate as:

Cost Centre = 12345678
OR
Member of Approved Exception Group

This creates an attribute-driven model with controlled exceptions. The majority of membership remains automated, while specific users can still be granted access when required. 

This approach combines operational efficiency with business flexibility. 

Why This Matters For organisations managing hundreds or thousands of users, dynamic membership provides several important benefits:

• ► Improved Governance
• ► Membership aligns with workforce data rather than manual administration
• ► Reduced Administrative Effort
• ► Team owners no longer need to continually add and remove users
• ► Better Security - Staff who move roles or leave the organisation can have access removed automatically as account attributes change
• ► Improved User Experience New starters gain access faster without requiring manual intervention
• ► Consistency Across Microsoft 365 The same dynamic membership logic can be reused for: Teams, SharePoint Online, Licensing Assignments, Exchange Distribution Groups

A Simple Rule of Thumb 

If your objective is simply to populate a Team once, then using a synchronised Active Directory security group may be sufficient. 

However, if your goal is: "Keep Team membership automatically aligned with organisational changes over time" then a Dynamic Microsoft 365 Group in Microsoft Entra ID is the recommended and Microsoft-supported solution. 

 Many organisations assume that synchronised Active Directory groups will automatically maintain Team membership because they have successfully managed access that way for years. However, Microsoft Teams was designed around Microsoft 365 Groups and Entra's dynamic membership capabilities rather than traditional security group expansion. 

The difference is significant:

Traditional AD Groups vs Dynamic Entra Groups

Traditional AD Group	Dynamic Entra Group
Manual maintenance	Automatic maintenance
One-time team population	Ongoing membership updates
Users can become out of sync	Membership remains aligned with business data
Higher administration overhead	Lower administration overhead
Reactive management	Proactive management

For modern Microsoft 365 environments, dynamic Entra groups provide the automation, governance and scalability that traditional synchronised Active Directory groups simply were not designed to deliver. 

When implemented correctly, they transform Team membership from something administrators constantly manage into something that effectively manages itself.