If you want to avoid manually adding individuals to the Defend user group in Microsoft 365, groups can be added instead.
Note: If the group being added has nested groups, the users within the group will not be added.
To do this, follow the steps below:
- Log in to Entra ID.
- Navigate to Identity > Groups > All groups > New groups.
- Under group type, select Microsoft 365.
- Under Membership Type, select Dynamic User.
- Select an Owner for the group.
- Select Add dynamic query.
- Click Edit next to the Rule syntax box and paste in the expression below. Replace GroupObjectID with the objectID of the group to be added.
Important:Microsoft is removing support for the memberOf operator shown in the rule syntax below, effective November 3, 2026. This removal does not delete or empty the dynamic group. Instead, it freezes at its last known membership. Users already in the group at that point will continue to be protected by Defend. However, any new employees added after November 3, 2026, will not be synced to the group, and their email will not be scanned by Defend. Before November 3, 2026, migrate to a static Microsoft 365 group, or update your dynamic group rule to remove the memberOf operator.
Rule syntax:
user.memberof -any (group.objectId -in ["GroupObjectID1", "GroupObjectID2"])