Dynamic groups versus ABAC
The difference between native Entra dynamic groups and ServiceChanger's ABAC approach, and when to use which.
What dynamic groups are
Dynamic groups are an Entra ID feature. A single group gets a membership rule and Entra fills that group automatically based on attributes. It is a fine solution for individual groups, but you manage each rule separately, per group, in the Entra portal.
What ServiceChanger does differently
ABAC in ServiceChanger works at tenant level across multiple groups at once. Instead of maintaining a separate rule per group, you define centrally which attribute grants which groups. That gives you:
- One view of which attribute grants which access, across your whole tenant.
- History and audit of changes, so you can look back at why someone was in a group.
- On-prem reach: the same rule can also fill on-prem AD groups, through the runbook and Entra Connect. Native dynamic groups are cloud only.
- Safe rollout: test a new rule on a small test group first before you apply it more broadly.
When dynamic groups are enough
If you have a handful of cloud-only groups with simple attribute rules and no on-prem AD, native dynamic groups are perfectly fine. ServiceChanger does not touch existing dynamic groups unless you actively put a rule on them.
When ServiceChanger fits
ServiceChanger is built for environments where:
- access is spread across many groups and attributes,
- you manage both Entra ID and on-prem AD,
- you want to validate and look back before and after you change anything,
- you want to clean up and consolidate groups instead of constantly adding new rules.
Group-based licensing
Group-based licensing is a separate, native Entra feature where Microsoft ties licenses to group membership. ServiceChanger does not do that itself. It fills the groups according to your rules and separately tracks usage of the licenses. Actually tying a SKU to a group stays with Microsoft. See License tracking.