SC-300 Exam Alignment
SC-300

Implement and manage user identities: Create and manage group types, configure dynamic membership rules, implement group-based licensing, and manage group expiration policies.

• Know the four group types (Security, Microsoft 365, Mail-enabled Security, Distribution) and their use cases
• Understand Assigned vs Dynamic User vs Dynamic Device membership — and which licence is required for Dynamic
• Write and interpret dynamic membership rule syntax using property-operator-value expressions
• Know how group-based licensing works and what happens when a user joins or leaves a group
• Know that group expiration requires Entra ID P1 and what happens when owners do not renew

Exam Tip: Dynamic group membership requires Entra ID P1. The most common exam scenario involves writing or correcting a dynamic rule. Remember the rule property names use camelCase (user.department, user.country, user.userType) and operators are case-insensitive (-eq, -ne, -in, -notIn, -startsWith, -contains, -match).

📋 Group Types in Microsoft Entra ID

🔄 Membership Types

⚡ Dynamic Membership Rules

Dynamic membership rules use a property-operator-value syntax to define which users automatically belong to a group. The rule is evaluated continuously — users are added or removed as their attributes change.

Entra admin center › Identity › Groups › [group] › Dynamic membership rules

📦 Group-Based Licensing

Group-based licensing (requires Entra ID P1) allows administrators to assign Microsoft 365 licences to a group. Every member of the group automatically receives that licence. When a user is removed from the group, the licence is automatically removed.

Entra admin center › Identity › Groups › [group] › Licences

Microsoft Entra admin center
|
Identity › Groups › HR Team › Licences

👥 Identity

Overview

Members

Owners

Licences

Dynamic membership rules

HR Team — Assigned licences

LicenceAssignedStatus

Microsoft 365 E3✅ ActiveInherited

Group has 24 members · 24 licences auto-assigned · 0 errors

When a member joins or leaves this group, their Microsoft 365 E3 licence is automatically added or removed.

⏰ Group Expiration Policies

Group expiration (requires Entra ID P1) lets administrators set a lifetime for Microsoft 365 Groups. Group owners receive email notifications at 30, 15, and 1 day before expiry. If no renewal happens, the group is soft-deleted and can be restored within 30 days.

Connect-MgGraph -Scopes 'Group.ReadWrite.All'

# Create a Security group with dynamic membership
New-MgGroup -DisplayName 'HR Department' -MailEnabled:\$false -MailNickname 'hr-dept' -SecurityEnabled:\$true -GroupTypes 'DynamicMembership' -MembershipRule 'user.department -eq "HR"' -MembershipRuleProcessingState 'On'

# Create a Microsoft 365 Group (Unified)
New-MgGroup -DisplayName 'Marketing Team' -MailEnabled:\$true -MailNickname 'marketing-team' -SecurityEnabled:\$false -GroupTypes 'Unified'

# List all dynamic groups and their rules
Get-MgGroup -Filter "groupTypes/any(c:c eq 'DynamicMembership')" | Select-Object DisplayName,MembershipRule

# List members of a group
Get-MgGroupMember -GroupId '<group-id>' | ForEach-Object { Get-MgUser -UserId \$_.Id | Select-Object DisplayName,UserPrincipalName }

💡 Best Practices

• Use dynamic groups for department, location, or role-based access — eliminates the operational overhead of manually maintaining group membership as your organisation grows
• Assign licences to groups rather than individual users — group-based licensing creates a consistent, auditable, and automated licence management process
• Always validate dynamic rules using the built-in Validate rules tool before saving — a wrong rule can incorrectly add or remove hundreds of users from licensed or privileged groups
• Enable group expiration for Microsoft 365 Groups to prevent accumulation of orphaned Teams, SharePoint sites, and shared mailboxes that are no longer actively used
• Use naming policies (Entra admin center → Identity → Groups → Naming policy) to enforce consistent group name prefixes or suffixes (e.g., GRP-HR-London) making groups easier to govern at scale

🎓 Interview Q&A