Static groups are managed manually, with members added and removed by an administrator. Dynamic groups use rules to assign membership automatically based on user or device attributes. Static groups give direct control but drift over time; dynamic groups reduce manual work but depend on accurate attribute data and well-tested rules. Review rule changes carefully to avoid unintended access.
How static and dynamic groups differ in day-to-day administration
Static groups are membership lists that an administrator maintains directly. They are useful when membership needs human judgment, exceptions, or deliberate review. dynamic groups replace manual membership changes with rules, so the directory evaluates attributes and updates membership automatically when those attributes change.
The practical difference is control versus automation. Static groups are easy to reason about because membership is explicit, but they tend to drift when people change roles, projects, or environments. Dynamic groups reduce administrative overhead and can keep pace with change, but only if the underlying attributes are reliable and the rule logic matches the business intent.
Why rule quality matters more for dynamic groups
Dynamic groups are only as accurate as the data and conditions behind them. A well-designed rule can keep access aligned to role, department, location, or device state without constant manual intervention. A poorly designed rule can overinclude users, exclude valid members, or update access in ways nobody noticed until the impact shows up in production.
That is why rule testing matters before and after rollout. Small syntax differences, incomplete attribute population, or inconsistent naming conventions can cause unexpected membership changes. In practice, the biggest failure mode is not the rule engine itself, it is assuming that the directory attributes are clean enough to automate access decisions safely.
For organisations using Microsoft Entra ID or Active Directory in hybrid environments, group design often sits alongside privileged access and delegated administration decisions in the Active Directory and Entra ID Hardening Guide, because group membership can become a control point for broad administrative reach.
When each group type is the better fit
Static groups work best when membership is intentionally narrow, change is infrequent, or access must be approved case by case. They are also a better fit when exceptions matter, because an administrator can add or remove a specific member without having to redesign logic.
Dynamic groups are a better fit when membership follows a repeatable pattern, such as all users in a department, all managed devices at a certain compliance state, or all accounts with a standard attribute set. They are especially useful where scale makes manual maintenance error-prone, but they should not be used to hide weak data governance.
In both cases, the real governance question is whether membership reflects an authoritative source of truth. If the source attributes are incomplete or loosely governed, dynamic membership can amplify mistakes just as quickly as static membership can accumulate them.
Risk and Threat Considerations
Static groups create accumulation risk, because old members and exceptions can remain long after the original need has passed. Dynamic groups create change-risk, because a bad rule or bad attribute can grant access to the wrong population at scale, often faster than a manual review cycle would catch it.
Failure mechanism: Static membership drifts through delayed cleanup, while dynamic membership fails through incorrect predicates, stale attributes, or unintended rule interactions that expand access automatically.
Impact: Both patterns can produce unauthorized access, but dynamic errors tend to have a wider blast radius because one rule change can alter membership for many accounts at once.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Group membership directly affects account and access lifecycle control. |
| AC-6 — Least Privilege | Static and dynamic groups both shape who receives permissions and breadth of access. | |
| Recommendation — Review group membership changes and remove stale access promptly. Limit group-based access to the minimum permissions required for the role. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Group membership is a practical mechanism for granting, reviewing and revoking access rights. |
| Recommendation — Define a process to grant, review and revoke group-derived access rights. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | Group membership is a core access control decision that determines entitlement. |
| Recommendation — Apply access control rules that keep group membership aligned to authorised need. | ||
Practitioner Guidance
What to verify: Treat the directory attribute model as part of the control, not just the group rule. Verify which attributes are authoritative, how often they change, and whether they are consistently populated before you rely on dynamic membership for access decisions.
Decision rule: Use static groups when membership is exception-driven or requires explicit approval, and use dynamic groups when the membership pattern is stable enough to encode as a rule and test repeatedly. If neither is true, the group is probably carrying a process problem rather than solving one.
Common mistake: Teams often move to dynamic groups for convenience and then stop reviewing the rule set. That creates silent access drift in a different form, especially when onboarding, transfers, and leavers are not reflected cleanly in upstream attributes.
Practitioner takeaway: Static groups expose governance discipline, while dynamic groups expose data quality and rule quality, so the safest design is the one whose failure mode you can actually detect and review.
Related resources from NHI Mgmt Group
- What is the difference between static and dynamic workload groups in microsegmentation?
- What is the difference between static and dynamic credentials?
- What is the difference between attack surface management and NHI governance?
- What is the difference between reviewing human access and reviewing NHIs?