How to Create Dynamic Teams in Microsoft Teams with Entra ID Rules

First, install the Microsoft Graph PowerShell SDK and connect with the required permissions. This gives you programmatic access to create and manage dynamic groups.

# Install Microsoft Graph modules
Install-Module Microsoft.Graph -Scope CurrentUser -Force

# Import required modules
Import-Module Microsoft.Graph.Groups
Import-Module Microsoft.Graph.Teams
Import-Module Microsoft.Graph.Users

Connect to Microsoft Graph with the necessary scopes:

# Connect with required permissions
Connect-MgGraph -Scopes "Group.ReadWrite.All","Team.ReadWrite.All","User.Read.All"

Before creating dynamic rules, verify that your users have the required attributes populated. Dynamic membership rules depend on these attributes being present and accurate.

# Check user attributes for your target users
Get-MgUser -Filter "department eq 'IT'" -Property DisplayName,Department,City,JobTitle | Select-Object DisplayName,Department,City,JobTitle

# Check specific user attributes
Get-MgUser -UserId "user@contoso.com" -Property Department,City,JobTitle,CompanyName

Common attributes used in dynamic rules:

• user.department - Department name
• user.city - City location
• user.jobTitle - Job title
• user.companyName - Company name
• user.country - Country

Create a Microsoft 365 group with dynamic membership rules. This group will automatically include users based on the attributes you specify.

# Define the dynamic group parameters
$groupParams = @{
    DisplayName = "IT-India-Dynamic"
    Description = "Dynamic team for IT users in Indian offices"
    MailEnabled = $true
    MailNickname = "itindiadynamic"
    SecurityEnabled = $false
    GroupTypes = @("Unified", "DynamicMembership")
    MembershipRule = '(user.department -eq "IT") and (user.city -in ["Bengaluru", "Mumbai", "Chennai"])'
    MembershipRuleProcessingState = "On"
}

# Create the dynamic group
$newGroup = New-MgGroup @groupParams
Write-Host "Group created with ID: $($newGroup.Id)"

# Wait for initial provisioning
Start-Sleep -Seconds 30

Common dynamic rule examples:

• Department-based: (user.department -eq "Sales")
• Location-based: (user.city -eq "London")
• Multiple conditions: (user.department -eq "Marketing") and (user.country -eq "United States")
• Job title pattern: (user.jobTitle -contains "Manager")

Convert your dynamic Microsoft 365 group into a Teams-enabled group. This creates the team interface while maintaining the dynamic membership.

# Create team from the dynamic group
$teamParams = @{
    GroupId = $newGroup.Id
}

try {
    $newTeam = New-MgTeam @teamParams
    Write-Host "Team created successfully for group: $($newGroup.DisplayName)"
} catch {
    Write-Error "Failed to create team: $($_.Exception.Message)"
}

# Wait for team provisioning
Start-Sleep -Seconds 60

Configure team settings (optional but recommended):

# Update team settings
$teamSettings = @{
    MemberSettings = @{
        AllowCreateUpdateChannels = $true
        AllowDeleteChannels = $false
        AllowAddRemoveApps = $true
        AllowCreateUpdateRemoveTabs = $true
        AllowCreateUpdateRemoveConnectors = $false
    }
    GuestSettings = @{
        AllowCreateUpdateChannels = $false
        AllowDeleteChannels = $false
    }
    MessagingSettings = @{
        AllowUserEditMessages = $true
        AllowUserDeleteMessages = $true
        AllowOwnerDeleteMessages = $true
        AllowTeamMentions = $true
        AllowChannelMentions = $true
    }
}

Update-MgTeam -TeamId $newGroup.Id -BodyParameter $teamSettings

Add owners to your dynamic team. Owners can manage team settings, channels, and apps, but cannot manually add or remove members due to the dynamic nature.

# Add team owners
$ownerEmails = @("admin@contoso.com", "teamlead@contoso.com")

foreach ($email in $ownerEmails) {
    try {
        $user = Get-MgUser -Filter "userPrincipalName eq '$email'"
        $ownerRef = @{
            "@odata.id" = "https://graph.microsoft.com/v1.0/users/$($user.Id)"
        }
        New-MgGroupOwnerByRef -GroupId $newGroup.Id -BodyParameter $ownerRef
        Write-Host "Added owner: $email"
    } catch {
        Write-Warning "Failed to add owner $email : $($_.Exception.Message)"
    }
}

Verify owners and current membership:

# Check group owners
Get-MgGroupOwner -GroupId $newGroup.Id | Select-Object Id, @{Name="Email"; Expression={(Get-MgUser -UserId $_.Id).UserPrincipalName}}

# Check current dynamic membership (may take time to populate)
Get-MgGroupMember -GroupId $newGroup.Id | Select-Object Id, @{Name="Email"; Expression={(Get-MgUser -UserId $_.Id).UserPrincipalName}}

Dynamic membership processing can take anywhere from a few minutes to 24 hours. Monitor the processing status and validate that the correct users are being added.

# Check membership rule processing status
$group = Get-MgGroup -GroupId $newGroup.Id -Property MembershipRule,MembershipRuleProcessingState
Write-Host "Rule: $($group.MembershipRule)"
Write-Host "Processing State: $($group.MembershipRuleProcessingState)"

# Get current member count
$memberCount = (Get-MgGroupMember -GroupId $newGroup.Id).Count
Write-Host "Current members: $memberCount"

# List all members with their attributes
Get-MgGroupMember -GroupId $newGroup.Id | ForEach-Object {
    $user = Get-MgUser -UserId $_.Id -Property DisplayName,Department,City,JobTitle
    [PSCustomObject]@{
        Name = $user.DisplayName
        Department = $user.Department
        City = $user.City
        JobTitle = $user.JobTitle
    }
} | Format-Table

Test your membership rule syntax:

# Validate rule syntax (create a test group first)
$testRule = '(user.department -eq "IT") and (user.city -in ["Bengaluru", "Mumbai"])'

# Check which users would match your rule
Get-MgUser -Filter "department eq 'IT'" -Property DisplayName,Department,City | 
    Where-Object { $_.City -in @("Bengaluru", "Mumbai") } | 
    Select-Object DisplayName,Department,City

Set up channels and configure team-specific settings. Since membership is dynamic, focus on creating a structure that works for any user matching your criteria.

# Create additional channels
$channels = @(
    @{ DisplayName = "Projects"; Description = "Project discussions and updates" },
    @{ DisplayName = "Resources"; Description = "Shared resources and documentation" },
    @{ DisplayName = "Announcements"; Description = "Team announcements" }
)

foreach ($channel in $channels) {
    $channelParams = @{
        TeamId = $newGroup.Id
        DisplayName = $channel.DisplayName
        Description = $channel.Description
        MembershipType = "standard"
    }
    
    try {
        New-MgTeamChannel @channelParams
        Write-Host "Created channel: $($channel.DisplayName)"
    } catch {
        Write-Warning "Failed to create channel $($channel.DisplayName): $($_.Exception.Message)"
    }
}

Configure team-wide settings for dynamic membership:

# Set team discovery and joining settings
$discoverySettings = @{
    IsDiscoverable = $true  # Allow users to find the team
    Description = "This is a dynamic team for IT users in Indian offices. Membership is automatically managed based on your Entra ID profile."
}

Update-MgTeam -TeamId $newGroup.Id -BodyParameter $discoverySettings

# List all channels to verify
Get-MgTeamChannel -TeamId $newGroup.Id | Select-Object DisplayName,Description

Test your dynamic team by modifying user attributes and monitoring membership changes. This helps validate your rules and troubleshoot any issues.

# Create a test user or modify existing user attributes
$testUser = "testuser@contoso.com"

# Update user attributes to match your rule
$userUpdate = @{
    Department = "IT"
    City = "Bengaluru"
    JobTitle = "Software Engineer"
}

Update-MgUser -UserId $testUser -BodyParameter $userUpdate
Write-Host "Updated test user attributes"

# Monitor membership changes (check periodically)
function Test-DynamicMembership {
    param($GroupId, $TestUserEmail)
    
    $members = Get-MgGroupMember -GroupId $GroupId
    $testUser = Get-MgUser -Filter "userPrincipalName eq '$TestUserEmail'"
    
    if ($members.Id -contains $testUser.Id) {
        Write-Host "✓ Test user is a member of the dynamic group" -ForegroundColor Green
    } else {
        Write-Host "✗ Test user is not yet a member" -ForegroundColor Yellow
        Write-Host "This is normal - processing can take up to 24 hours"
    }
    
    return $members.Count
}

# Run the test
$memberCount = Test-DynamicMembership -GroupId $newGroup.Id -TestUserEmail $testUser

Common troubleshooting commands:

# Check for processing errors
Get-MgGroup -GroupId $newGroup.Id -Property MembershipRuleProcessingStatus

# Verify rule syntax
$rule = '(user.department -eq "IT") and (user.city -in ["Bengaluru", "Mumbai"])'
Write-Host "Current rule: $rule"

# Check attribute population across your user base
Get-MgUser -Filter "department eq 'IT'" -Property Department,City | 
    Group-Object City | 
    Select-Object Name, Count