Using Dynamic Office 365 Groups with Teams

Teams and Dynamic Office 365 Groups

Despite having some dynamic teams working in my tenant, some people told me that Microsoft doesn’t support dynamic Office 365 Groups when used with Teams. The documentation covering Office 365 Groups and Teams doesn’t address the point, so there doesn’t seem to be a formal restriction. At least, there wasn’t until I tried to team-enable a new dynamic Office 365 group and ran into an error.

I asked the Teams development group whether dynamic teams are supported. They admitted that some people had got dynamic teams to work (like me) but as they hadn’t completed the work to validate that dynamic teams work properly in all scenarios, they had placed a block on the creation of new dynamic teams. Microsoft will enable the feature when they complete their development and test work, and hopefully this will happen soon. We have updated Office 365 for IT Pros (August 28) to reflect the current situation.

A Dynamic Team

Every team is represented by an Office 365 Group. The membership of the group represents the membership of the team. The group can be made up of static or dynamic membership. A dynamic group uses a query against Azure Active Directory to calculate its membership. You cannot create a team with dynamic membership using a Teams client or with the PowerShell New-Team cmdlet. Instead, you create the dynamic group through the Azure Active Directory portal and then team-enable the group.

Figure 1 shows an example. The top is an extract of properties for a dynamic group taken from the Azure Active Directory portal. We can see that the membership type is dynamic and that the group has five members. The bottom is the membership visible in Teams. Five members are shown, which is what we expect.

Pictures of the Marketing department - a team that uses a dynamic group
Figure 1: The Marketing Department – a team using a dynamic group

All of this is based on experience with dynamic teams created before Microsoft initiated the block. Things could change in the future!

Owners and Members

Each team should have at least one owner. The person who creates a new team automatically becomes an owner, unless they decide not to and nominate another user for the role. You can add other owners via the Azure Active Directory portal, PowerShell, or by updating the role of a member to become an owner.

Owners are always members of the team, but they are static in that their membership does not depend on the query executed against Azure Active Directory. In other words, a dynamic group has two membership lists – one is static (the owners), and one is dynamic (the members). The dynamic list is actually composed of the owners and the members computed by the query against Azure Active Directory. You don’t see two sets in the dynamic list because the user interfaces combine the two into one seamless set.

But if you use the Get-TeamUser cmdlet to examine members of a team, you see:

While if you run the Get-AzureADGroupOwner and Get-AzureADGroupOwner cmdlets to examine the underlying group in Azure Active Directory, you see the two sets:

Some members are marked with UserType = Member while others are not. There’s a slight inconsistency in how users are tagged that I can’t quite explain. But everything works.

Problems

Although dynamic teams do work (if you configured them before Microsoft blocked the feature), it’s fair to say that some gotchas exist. One example of an edge case is when you demote an owner to become a member. If the demoted user does not come within the scope of the query used to populate the team membership, they are removed from the membership.

Another problem is that no documentation exists, work that would flow from testing.

Some attention might be needed to improve the synchronization between Azure Active Directory and Teams to respect changes made in dynamic membership. Anyone who has made a change to Azure Active Directory knows that Teams is sometimes not fast when it comes to synchronization, which could be a problem when dynamic membership changes. When an administrator updates the query underlying a dynamic group, background jobs evaluate the query and compute the new membership. Any changes must then be synchronized from Azure Active Directory to Teams, and then replicated to the local cache in clients.

I’m sure that Microsoft knows of all these issues and is working to resolve them before the formal launch of dynamic teams.

For More Information

For more information about Dynamic Office 365 Groups, see Chapter 12 of Office 365 for IT Pros. For more information about Teams, see Chapter 13.

2 Replies to “Using Dynamic Office 365 Groups with Teams”

    1. It’s coming. I expect it to be quite soon as the functionality is being tested in beta now.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.