Creating a dynamic group, excluding members of a group

@Pellin, Lisa, Thanks for posting in Q&A.

From your description, I know you want to create a dynamic group and exclude members of another group

Based on my research, what you'll want to do is find an attribute that either the included user accounts or device have, and the excluded accounts or devices don't, or an attribute the excluded accounts have but the included user accounts or devices don't. Then you base your filter on this. For example, if some service accounts do not have an office location, but other user accounts do, so you can filter based on this for location specific DLs.

https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership

Or you can see whether configure dynamic membership groups with the memberOf attribute in the Azure portal can meet your needs.

https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-rule-member-of

Hope it will help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.