Created by Claude - please verify

Dynamic group health - member counts come from the cached groups (first page, members truncated), so treat 0 as a hint, not proof.

Required Microsoft Graph permissions

Group.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1 (dynamic groups).

Endpoint: GET /v1.0/groups?$filter=groupTypes/any(c:c eq 'DynamicMembership')

Graph v1.0 exposes the processing state (On / Paused), not rule-evaluation errors; those are only in the Entra admin center.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Dynamic Group Rule Health

Dynamic groups drive licensing, app access and Conditional Access. A paused rule freezes membership - joiners get nothing, leavers keep everything - and a rule that matches nobody usually means an attribute was renamed or is not populated.

This tenant has no dynamic groups.