To validate the membership of a dynamic Entra ID group the documentation specifies the required permissions.
To evaluate the rule for dynamic membership groups, the administrator must be at least a Groups Administrator.
In the Entra ID Admin roles documentation, the permission for Groups Administrator is mentioned.
microsoft.directory/groups/dynamicMembershipRule/update
Update the dynamic membership rule on Security groups and Microsoft 365 groups, excluding role-assignable groups
A search shows the permission is active in five roles:
- Directory Writers
- Groups Administrator
- Intune Administrator
- User Administrator
- Windows 365 Administrator
One of my test accounts is assigned the Intune Administrator role.
- The account belongs to a role group that has been assigned the Intune Administrator role. As a result, the account inherits the role through this group.
- The role was assigned to the group as an Active Assignment, meaning it will remain permanently active for a specified period of time.
My colleague Alex Wilber created a new dynamic Entra ID group in Intune and wants to perform a membership validation for an account. Intune will indicate that the account does not have permissions to validate.
Insufficient privileges to update the membership rule for the group. Make sure you have the right permissions.
The evaluation could not be performed, this user does not have appropriate permissions. Please contact your administrator to request permissions.
The cause is the assignment of the Intune Admin role via a role group in Active Assignment status.
In practice, this is the same problem as in my post from October about a missing Group Administrator role. Some permissions in Entra do not support role groups. In the current case, the leading cause is the Active Assignment in combination with a role group.
There are two ways to solve this:
- You change the assignment from Active Assignment to Eligible Assignment. Alex Wilber uses Privileged Identity Management (PIM) in that case, his account requires an Entra ID P2 license. The validation works for a dynamic group after activating the Intune Admin role.
- You directly assign the Intune Admin role to the account (in Active Assignment status). Alex Wilber can validate a dynamic group after a direct assignment.
In both cases, the validation works with the Intune Administrator role.
