This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(44.800000000000004, 1%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESR%3C/text%3E%3C/svg%3E)
I am working on configuring a Purview Exchange policy to encrypt data shared outside our organization. I want to include users through a dynamic security group specifically for E3 and E5 licensed users. The challenge is that the group needs to automatically update as user licenses change, but currently, Purview only supports mail-enabled groups or distribution groups for policy application.
Unfortunately, converting this dynamic security group into a mail-enabled group is not feasible in our setup. Could you advise on any potential workarounds for this limitation? How do other organizations manage to apply Purview policies to all new users with assigned licenses without manually adding them to a distribution group every time a license is assigned?
Additionally, if I were to apply the policy broadly to all users, are there any implications for those who do not have the necessary licenses? I'm concerned about the impact this might have on users who aren't covered under the appropriate licensing terms.
Thank you for any insights or advice you can provide.
You should be able to also use Microsoft 365 Groups for scoping, including those with dynamic membership. Have you tried that?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(252.8, 99%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJN%3C/text%3E%3C/svg%3E)
Hi @Shane Remelt
In addition to the @Vasil Michev information
You might be able to use a Microsoft 365 Group with dynamic membership if it can be mail-enabled. Have you checked whether Purview allows scoping policies to Microsoft 365 Groups in your tenant? If Purview doesn’t support it, we may need to explore other automation options, such as syncing users from the dynamic security group into a mail-enabled distribution list automatically.
Hope this helps. Do let us know if you any further queries.
@Shane Remelt
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Hi Vasil. I tried to use a Microsoft 365 group but I was not able to add anything that mentioned e3/e5 licensing such as this rule I have on the Entra Group
user.assignedPlans -any (assignedPlan.servicePlanId -eq "41781fb2-bc02-4b7c-bd55-b576c07bb09d" -and assignedPlan.capabilityStatus -eq "Enabled")
I see canned options but nothing specific to license status.
Microsoft 365 Groups use the same syntax as Entra security groups for dynamic membership rules. Make sure you do configure this via the Entra portal, or the Graph API/PowerShell, and not the M365 admin center.
Also, if you are going to create the M365 group via the UI, make sure it's also security-enabled. Update-MgGroup can do this for you.
@Shane Remelt
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Hi Vasil, I was able to add that syntax the the m365 group however I had some trouble making it security enabled.
Thanks for the help so far.
Hi Vasil, hopefully this isn't a double post as my last one isn't showing but I was able to add the rules to the 365 group but not add modify it to be security enabled.
It's a switch parameter, so either don't provide a value or use -SecurityEnabled:$true
@Shane Remelt
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Hi Vasil, that worked!
Anyway to remove the sharepoint and teams site this ends up creating? I would rather not have those if possible.
Unfortunately, no. We've been asking for this for years, but Microsoft is yet to address such scenarios.
Aw! No worries. This will have to do.
Thank you for the help.