A query-based group is an Active Directory group whose membership is calculated from directory attributes rather than maintained by hand. The group updates when the underlying user or object data changes, which helps keep access and distribution rules aligned with current roles, departments, locations, or other defined criteria.
What a query-based group is
A query-based group is not a manually curated list of members. It is a directory-backed group whose membership is evaluated from user or object attributes, so changes in those attributes automatically change who qualifies.
That makes the group behave more like a rule than a roster. If the query is built around department, location, job title, account type, or another directory field, the group can stay aligned with current data without repeated manual updates.
How membership is calculated
Membership is determined by the query logic, not by someone adding or removing accounts one by one. In Active Directory, that usually means the system evaluates a defined filter against directory objects and includes the objects that match at that moment.
This model is useful when the population is expected to move, because the group can track organisational change automatically. A user can enter, leave, or move between matching attribute values and the membership outcome changes accordingly.
The important tradeoff is that the query becomes the source of truth. If the attributes are inaccurate, stale, inconsistent, or poorly maintained, the group will still update correctly relative to the data, but incorrectly relative to the business intent.
Why query-based groups matter for access and distribution
These groups are commonly used for access assignment, email distribution, and other rule-driven targeting where the underlying criterion is stable and easy to express. They reduce manual administration and make it easier to keep permissions and notifications in sync with directory state.
From a security perspective, they matter because they can either improve or widen access depending on the query. A broad rule can sweep in more accounts than intended, while a narrow or precise rule can support cleaner least-privilege alignment when the attribute model is trustworthy.
Because the membership is attribute-driven, the quality of the directory schema becomes part of the control design. The group is only as accurate as the fields it depends on, and attribute drift can create hidden overexposure or missed access.
How query-based groups differ from manual groups
Manual groups depend on a person to add and remove members. Query-based groups shift that maintenance to the directory engine, which makes them better suited to repeatable population rules and large or fast-changing user sets.
This also changes the operational failure mode. With manual groups, the main risk is missed maintenance. With query-based groups, the main risk is bad logic, bad data, or an attribute source that does not reflect the real-world condition the group is meant to represent.
In practice, the best use cases are those where the membership criterion can be expressed unambiguously and monitored over time. If the business rule is ambiguous, exceptions are common, or the attribute set is unreliable, a manual or hybrid approach may be safer.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Query-based groups automate population of account memberships. |
| AC-6 — Least Privilege | Attribute-driven group membership can expand or constrain effective access. | |
| Recommendation — Review account-group logic to keep membership aligned with current role criteria. Limit query scope so group membership supports least-privilege access. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Directory groups are a core access-control mechanism in access governance. |
| A.8.2 — Privileged access rights | Dynamic group membership can affect privileged entitlements if used for admin access. | |
| Recommendation — Define and govern directory group rules as part of access control policy. Restrict query-based groups that influence privileged access rights. | ||
| CIS Controls v8 | CIS-5 — Account Management | CIS account management covers maintaining authoritative group membership. |
| Recommendation — Use automated group rules to reduce manual account maintenance errors. | ||
Practitioner Guidance
Governance implication: Treat the query itself as a controlled object, because the group’s effective membership can change as soon as directory data changes. Review the attribute source, the matching logic, and any downstream permissions or distribution lists that depend on the group.
What to watch for: Look for overly broad filters, weakly governed attributes, and stale object data, since those conditions can make the group silently grant or retain access that no longer reflects business intent.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
