Helpdesk: "Jordan changed departments yesterday and still gets every email to Sales-All. Priya started in Marketing two days ago and never appears on the Marketing DDG. Marcus says the group looks empty in EAC right after we created it. Can you just rebuild the dynamic distribution group, or force it to sync like an Entra dynamic group?"
Don't rebuild the DDG yet. Exchange Online dynamic distribution group "not updating" is usually one broken layer in a documented chain, not a missing sync button: you're looking at the wrong group type (Entra dynamic security / M365 group vs Exchange DDG) → the recipient filter doesn't match the attributes you think it does → preview and stored membership disagree because the list is still calculating or waiting on the 24-hour refresh → attribute sync / exact-match values are wrong → mail delivery is blocked even though membership is fine. Microsoft's manage-DDG, troubleshoot-membership, RecipientFilter, and Set-DynamicDistributionGroup articles are the sources for that chain — not a tip that says "delete and recreate."
If the real problem is an Entra ID dynamic security or Microsoft 365 group (membershipRule / memberOf), start with Entra Dynamic Group Not Updating. If people can't send as the group, use Send As Permission Not Working. If mail vanishes after it reaches Exchange, check Exchange Online Mail Flow Rule Not Working. This post covers "the Exchange Online dynamic distribution group's membership list is empty, stale, or wrong — or mail to it doesn't match who should be on it."
TL;DR
- Exchange DDGs are not Entra dynamic groups. Microsoft: DDG membership is calculated and stored, then refreshed at least once every 24 hours. DDGs are not synced from Exchange Online to Microsoft Entra ID, so Conditional Access and Entra-scoped features cannot target an EXO DDG.
-
Preview the filter before you rebuild.
Get-Recipient -RecipientPreviewFilter $ddg.RecipientFiltershows who matches the rules right now.Get-DynamicDistributionGroupMembershows the stored membership list used for delivery. If preview is right and members are wrong → timing / refresh. If preview is wrong → fix the filter or attributes. - Lifecycle timing (document late May 2026 change): create or change rules with 5,000 or fewer matching members → membership populates / recalculates immediately; more than 5,000 → background process within up to 2 hours (during recalculation the DDG keeps the previous list). After that, every DDG refreshes at least once every 24 hours.
-
Pre-canned filters require exact attribute values. Microsoft:
Washingtondoes not matchWA. Text values aren't case-sensitive (Contosomatchescontoso), but spelling and abbreviations must match the recipient property. -
Force refresh is a last read-backed step, not first aid.
Set-DynamicDistributionGroup -ForceMembershipRefreshonly after more than 1 hour since the last membership refresh, and only when create/recalc is past the documented windows or the 24-hour refresh was missed. PowerShell only — not in EAC. -
Membership ≠ delivery. Empty AcceptMessagesOnlyFrom lists,
RequireSenderAuthenticationEnabled, moderation, and mail-flow rules can make "the group isn't working" look like a membership bug when the list is fine.
Where in the chain did it break?
| Step | What should be true | Typical symptom when it breaks |
|---|---|---|
| 1. Symptom captured | Empty vs stale vs wrong people vs delivery-only; Service Health checked | "DDG broken" with no preview vs member comparison |
| 2. Object is an EXO DDG | Recipient type DynamicDistributionGroup; not Entra DynamicMembership | Ticket assumes Entra processing / memberOf |
| 3. Filter readable | RecipientFilter or Conditional* / IncludedRecipients known; ManagedBy set | "Nobody knows the rule"; custom filter only in PowerShell |
| 4. Preview vs stored members | Preview matches intent; members match preview after wait | Preview good, EAC members stale (or reverse) |
| 5. Refresh timing respected | CalculatedMembershipUpdateTime within expected window | "Not updating" 30 minutes after a department change |
| 6. Attributes match exactly | Company / Department / CustomAttributeN / sync lag checked | Filter looks right; preview empty |
| 7. Delivery path sane | Auth / AcceptMessages / moderation / message trace | Members correct; external or some senders bounce |
| 8. Right tool for the job | DDG still appropriate vs M365 group / static DL | Rebuilding a DDG that should have been a Teams/M365 group |
Step 1: Capture the exact symptom (read-only)
Write four facts on the ticket before New-DynamicDistributionGroup or delete/recreate:
| Fact | Why it matters |
|---|---|
| Symptom class | Empty list / missing joiner / leftover leaver / wrong people / mail NDR / Outlook expansion looks wrong |
| When | Brand-new DDG vs rule change today vs attribute change yesterday vs "always been wrong" |
| Who | One user, one department, or everyone who should match |
| Where you looked | EAC Members tab, Outlook expand, message trace, PowerShell |
Then compare:
- Does EAC → Recipients → Groups → Dynamic distribution list → Members → View all members show anyone?
- Does Outlook expand the group (client GAL/cache) or only delivery fail?
- Is the object under Dynamic distribution, or is it a Microsoft 365 group / distribution list / security group with mail?
- Check Microsoft 365 Service Health for Exchange Online before you rewrite filters.
| Pattern | Likely layer |
|---|---|
| New DDG empty for under 2 hours; large expected membership | Initial population still running (Step 5) |
| Joiner missing / leaver still included after attribute change same day | Routine 24-hour refresh not due yet (Step 5) |
| Preview empty; attributes "look right" in GUI | Exact-match / IncludedRecipients / RecipientContainer (Steps 3, 6) |
| Preview correct; Get-DynamicDistributionGroupMember wrong | Stale stored list / recalc in progress (Steps 4–5) |
| Members correct; some senders get NDR | Delivery management / moderation / mail flow (Step 7) |
| Ticket says "dynamic group" but object is Entra | Wrong product — use DEVTO_59 |
Step 2: Confirm it is an Exchange Online DDG (read-only)
Get-DynamicDistributionGroup -Identity 'sales-all@contoso.com' |
Select-Object Name, PrimarySmtpAddress, RecipientTypeDetails, ManagedBy,
RecipientFilter, IncludedRecipients, ConditionalCompany,
ConditionalDepartment, ConditionalStateOrProvince,
RecipientContainer, CalculatedMembershipUpdateTime,
HiddenFromAddressListsEnabled, RequireSenderAuthenticationEnabled,
ModerationEnabled
| Object | Engine | Updates how |
|---|---|---|
| Exchange Online dynamic distribution group | Exchange recipient filter + stored membership list | Create/change + ≥24 h refresh (see Step 5) |
| Entra dynamic security / M365 group |
membershipRule processing |
Entra processing status / Validate Rules (DEVTO_59) |
| Static distribution group / mail-enabled security group | Manual / synced members | Add/Remove-DistributionGroupMember |
| Microsoft 365 group | Unified group membership | Owners/members / dynamic Entra rule if enabled |
Microsoft documents explicitly: DDGs aren't synced from Exchange Online to Microsoft Entra ID or on-premises AD, so Azure Conditional Access cannot be scoped to an EXO DDG. If the ticket expected Entra-style "force processing," that control does not exist on this object.
ManagedBy (owners): EAC requires an owner at create time. In PowerShell, read ManagedBy (and -IncludeManagedByWithDisplayNames on Get when you need display names in EXO). Missing or wrong owners don't usually empty membership, but they block who can manage the group in EAC and who receives moderation fallbacks when moderators aren't set — capture owners before you change filters.
Step 3: Read the membership rules (read-only)
Two rule styles exist:
| Style | Where you edit | Logic |
|---|---|---|
| Pre-canned | EAC or PowerShell (IncludedRecipients, ConditionalCompany, ConditionalDepartment, ConditionalStateOrProvince, ConditionalCustomAttribute1–15) |
Multiple conditions combine with AND only |
| Custom recipient filter |
PowerShell only (-RecipientFilter OPATH) |
AND / OR / richer properties; cannot edit custom filters in EAC |
Microsoft warning for Exchange Online custom filters: a wildcard as a prefix (for example Property -like '*abc') is not supported for DDG recipient filters (performance). Prefer suffix/contains patterns Microsoft documents as supported, or exact -eq values.
Also note IncludedRecipients / recipient-type checkboxes (MailboxUsers, MailUsers, MailContacts, Resources, MailGroups, etc.). A perfect Department filter still returns nobody if you limited the group to the wrong recipient types.
RecipientContainer (scope): filters only evaluate recipients under that OU/container. Preview commands should use the same container when you compare (see Microsoft's Get-DynamicDistributionGroup example that passes -OrganizationalUnit $ddg.RecipientContainer).
$ddg = Get-DynamicDistributionGroup -Identity 'sales-all@contoso.com'
$ddg | Format-List Name, RecipientFilter, LdapRecipientFilter, IncludedRecipients,
Conditional*, RecipientContainer, ManagedBy, CalculatedMembershipUpdateTime
LdapRecipientFilter is the LDAP form Exchange stores — useful when comparing hybrid/on-prem mental models, but edit via OPATH RecipientFilter / pre-canned parameters, not by hand-editing LDAP strings unless you know that path is supported in your scenario.
Step 4: Preview filter results vs stored members (read-only)
Microsoft's preview guidance (PowerShell only — not in EAC):
$ddg = Get-DynamicDistributionGroup -Identity 'sales-all@contoso.com'
# Who matches the rules right now (adjust ResultSize as needed):
Get-Recipient -RecipientPreviewFilter $ddg.RecipientFilter -ResultSize 100 |
Select-Object DisplayName, PrimarySmtpAddress, RecipientTypeDetails, Department, Company
# If RecipientContainer is set, scope the preview the same way:
# Get-Recipient -RecipientPreviewFilter $ddg.RecipientFilter -OrganizationalUnit $ddg.RecipientContainer -ResultSize 100
# Stored membership list used for delivery / EAC members:
Get-DynamicDistributionGroupMember -Identity $ddg.Identity |
Select-Object DisplayName, PrimarySmtpAddress, RecipientTypeDetails
| Preview | Stored members | Meaning |
|---|---|---|
| Expected people | Expected people | Membership OK — look at delivery / client expansion (Steps 7–8) |
| Expected people | Empty or old set | Still populating / recalculating, or waiting on refresh (Step 5) |
| Missing expected people | Same missing set | Filter or attributes wrong (Steps 3, 6) |
| Extra people | Same extras | Filter too broad / wrong IncludedRecipients |
| Expected people | Different wrong set mid-change | Recalc in progress — DDG keeps previous list during recalculation |
Don't trust Outlook's expand-to-members UI as the source of truth for DDG membership. Client address books can lag; PowerShell preview + Get-DynamicDistributionGroupMember are the admin reads Microsoft documents.
Step 5: Read last refresh and respect the lifecycle (read-only, then optional force)
(Get-DynamicDistributionGroup -Identity 'sales-all@contoso.com').CalculatedMembershipUpdateTime
In EAC: Recipients → Groups → Dynamic distribution list — use the Last refreshed column.
Microsoft's membership lifecycle (hedge: these are documented operational windows, not a contractual minute-level SLA):
| Event | ≤ 5,000 matching members (late May 2026+) | > 5,000 matching members |
|---|---|---|
| Create (initial population) | Populates immediately; usable right away | Background process within up to 2 hours; empty until done |
| Modify membership rules | Recalculates immediately | Within up to 2 hours; previous list still used during recalc |
| Routine refresh | At least once every 24 hours (all sizes) | Same |
Implications Microsoft calls out:
- A user who leaves a matching department can keep receiving DDG mail until the next refresh.
- A user who newly matches may not receive DDG mail until the next refresh.
- Mail flow rules that depend on DDG membership use the same stored list, so they inherit the same staleness.
Force membership refresh (only when the windows above are already exceeded):
# Only after more than 1 hour since the last membership refresh (Microsoft note).
# Set-DynamicDistributionGroup -Identity 'sales-all@contoso.com' -ForceMembershipRefresh
Use force when: empty more than 2 hours after create; not recalculated more than 2 hours after a rule change; or not refreshed within the expected 24-hour interval. You cannot force refresh in EAC.
Step 6: Fix attributes and exact-match surprises (read-only first)
Pre-canned filters match exact property values. Microsoft's example: filter Washington does not match recipient WA. Text compares aren't case-sensitive.
# Confirm what Exchange sees on the user (not only what HR UI shows):
Get-Recipient -Identity 'priya@contoso.com' |
Select-Object DisplayName, Department, Company, StateOrProvince,
CustomAttribute1, CustomAttribute10, RecipientTypeDetails,
Office, Title, RecipientOU
Get-User -Identity 'priya@contoso.com' |
Select-Object Department, Company, StateOrProvince, CustomAttribute1
| Trap | What to check |
|---|---|
| Abbreviation vs full name | State/Province, Company, Department spelling |
| Wrong recipient type included | Mailbox vs MailUser vs MailContact vs Guest |
| Hybrid / Entra Connect lag | Attribute updated in AD but not yet on the EXO recipient |
| Extension / custom attributes | CustomAttribute1–15 vs a different directory extension Entra uses |
| RecipientContainer too narrow | User mailbox OU outside the DDG container |
| Prefix wildcards in custom filters | Unsupported for EXO DDG RecipientFilter per Microsoft |
Hybrid note (hedged): cloud-only DDGs live in Exchange Online and are not written back to on-premises AD / Entra as group objects. On-premises Exchange DDGs are a different lifecycle (often evaluated differently than EXO's stored list model). If the ticket is "hybrid dynamic distribution group not syncing," separate where the DDG was created (on-prem vs EXO) from whether the user's attributes synced into the environment that hosts the filter. Don't delete the EXO DDG to "resync" it like an Entra Connect group.
Step 7: Membership vs delivery (read-only)
When Get-DynamicDistributionGroupMember looks right but users say "the group doesn't work," read delivery settings before touching the filter:
Get-DynamicDistributionGroup -Identity 'sales-all@contoso.com' |
Select-Object Name, RequireSenderAuthenticationEnabled, ModeratedBy,
ModerationEnabled, AcceptMessagesOnlyFrom,
AcceptMessagesOnlyFromDLMembers, AcceptMessagesOnlyFromSendersOrMembers,
RejectMessagesFromSendersOrMembers, HiddenFromAddressListsEnabled
| Symptom | Likely delivery layer |
|---|---|
| External senders NDR; internal OK |
RequireSenderAuthenticationEnabled / "only inside organization" |
| Only some internals can send | AcceptMessagesOnlyFrom* allow lists |
| Mail sits / delayed / rejected after submit | Moderation enabled; check ModeratedBy / owners |
| GAL missing the group |
HiddenFromAddressListsEnabled (delivery can still work by SMTP) |
| Members right; message rewritten/dropped | Transport rule — mail-flow triage |
Run a message trace for a failed send to the DDG address before rewriting RecipientFilter.
Send As / Send on Behalf on the DDG itself is a delegate problem, not membership — see Send As Permission Not Working.
Step 8: DDG vs Microsoft 365 groups — when not to rebuild
| Need | Prefer |
|---|---|
| Email blast to everyone matching Department/Company/CustomAttribute | Exchange DDG |
| Team collaboration (SharePoint, Teams, Planner) + email | Microsoft 365 group |
| Entra Conditional Access / Intune assignment targeting | Entra security group (dynamic or assigned) — not an EXO DDG |
| Stable named list with rare changes | Static distribution group / MESG |
| Guests in a collaborative workspace | M365 group / Teams patterns |
Rebuilding a DDG because someone expected Teams files or CA exclusion groups will not fix the ticket. Delete/recreate also risks SMTP address, Send As delegates, moderation, and allow-list settings you already verified.
Step 9: Change one thing (only after the read)
After preview, timestamp, and attribute checks agree on the layer:
# Example: correct a custom filter (PowerShell only for custom RecipientFilter).
# Preview the NEW filter string with Get-Recipient -RecipientPreviewFilter FIRST.
# Set-DynamicDistributionGroup -Identity 'sales-all@contoso.com' -RecipientFilter "(RecipientTypeDetails -eq 'UserMailbox') -and (Department -eq 'Sales')"
# Example: pre-canned department correction (EAC Members rules or):
# Set-DynamicDistributionGroup -Identity 'sales-all@contoso.com' -ConditionalDepartment 'Sales' -IncludedRecipients 'MailboxUsers'
# Example: force refresh only when Microsoft's wait windows are already exceeded:
# Set-DynamicDistributionGroup -Identity 'sales-all@contoso.com' -ForceMembershipRefresh
Retest:
- Re-run
Get-Recipient -RecipientPreviewFilter— does the intended set appear? - Check
CalculatedMembershipUpdateTimeand EAC Last refreshed. - Re-run
Get-DynamicDistributionGroupMemberafter the documented immediate / ≤2 h window. - Send one test message from an allowed internal user; confirm delivery with message trace — don't use Outlook expand alone.
Microsoft note: you cannot replace a pre-canned filter with a custom OPATH filter (or the reverse) by casually flipping parameters — Set-DynamicDistributionGroup modifies the existing filter style. If you truly need to switch styles, plan a new DDG and a cutover; don't assume in-place conversion.
When a change is justified
| Finding | Prefer | Avoid |
|---|---|---|
| Preview wrong; attribute typo / WA vs Washington | Fix recipient attribute or filter value | Delete/recreate the DDG |
| Preview right; members stale < 24 h after HR change | Wait for routine refresh; communicate staleness | Force refresh every ticket |
| Empty > 2 h after create/rule change (or missed 24 h) |
-ForceMembershipRefresh (after >1 h since last refresh) |
Rebuilding SMTP + delegates |
| Custom filter needs OR / extra properties | Proper -RecipientFilter in PowerShell |
Trying to edit custom filter in EAC |
| External NDR; members fine | Adjust delivery management / auth | Changing Department filters |
| Needed CA / Intune targeting | Create Entra security group | Expecting EXO DDG in Entra |
| Needed Teams/SharePoint workspace | M365 group | Forcing DDG to be a collab surface |
| Send As on the DDG fails | Grant Send As on the group (DEVTO_60) | Refreshing membership |
FAQ
Why is my dynamic distribution group not updating?
In order of how often it happens in Exchange Online: the membership list is still within the create/recalc window or waiting on the 24-hour refresh; the RecipientFilter / pre-canned values don't exactly match recipient attributes; IncludedRecipients or RecipientContainer excludes the user; you're troubleshooting an Entra dynamic group by mistake; or delivery settings make a healthy membership look broken. Compare Get-Recipient -RecipientPreviewFilter to Get-DynamicDistributionGroupMember before rebuilds.
How do I force a dynamic distribution group to update?
Use Exchange Online PowerShell: Set-DynamicDistributionGroup -Identity <DDG> -ForceMembershipRefresh. Microsoft: only after more than one hour since the last membership refresh; not available in EAC. Prefer this when create/recalc exceeded ~2 hours or the 24-hour refresh was missed — not as the first response to a same-day department change.
What's the difference between preview and members?
Preview (Get-Recipient -RecipientPreviewFilter) evaluates who matches the rules now. Members (Get-DynamicDistributionGroupMember / EAC View all members) is the stored list Exchange uses for delivery until the next calculation/refresh. They can disagree on purpose during recalculation and between 24-hour refreshes.
Dynamic distribution group vs Entra dynamic group — which do I have?
If it appears under Exchange admin center Recipients → Groups → Dynamic distribution list and Get-DynamicDistributionGroup works, it's an Exchange DDG. If it has an Entra dynamic membership rule / membershipRule in Microsoft Entra admin center, use the Entra triage. DDGs do not sync to Entra for Conditional Access targeting.
Can I use a dynamic distribution group for Conditional Access or Intune?
No. Microsoft: DDGs aren't synced from Exchange Online to Microsoft Entra ID, so features like Azure Conditional Access don't support being scoped to an EXO DDG. Use an Entra security group (assigned or dynamic) for those workloads.
Related posts
- Entra Dynamic Group Not Updating (Entra membershipRule / memberOf — Step 8 there is the short Exchange DDG sidebar this post expands)
- Send As Permission Not Working (Send As / Send on Behalf on mailboxes and groups, including DDGs)
- Shared Mailbox Not Showing in Outlook (client visibility vs server-side membership)
- Does a Shared Mailbox Need a License? (EXO recipient limits adjacent to group design)
- Exchange Online Mail Flow Rule Not Working (when delivery fails after membership is correct; rules also consume the stored DDG list)
- A Monthly Exchange Online Hygiene Check (read-only EXO permission/forwarding inventory)
Free checklist
DDG membership tickets often land in the same week as a Conditional Access or MFA rollout, when "Sales-All is wrong" and "I can't sign in" share one queue. Before you enforce, the free Conditional Access pre-enforcement checklist keeps break-glass accounts, pilot groups, and report-only review on one page:
If you want the rest of the M365 admin runway written down for the team (break/fix cards, offboarding and mailbox decisions, and read-only PowerShell snapshots), the Intune & M365 Admin Starter Pack pairs with this triage: https://cashflow4375.gumroad.com/l/joonf?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=dynamic-distribution-group-not-updating
Admin Pack Studio; not affiliated with Microsoft. Steps 1–8 only read: EAC group properties, Get-DynamicDistributionGroup, Get-DynamicDistributionGroupMember, Get-Recipient -RecipientPreviewFilter, Get-Recipient / Get-User attribute checks, and message trace. Set-DynamicDistributionGroup (including -RecipientFilter, pre-canned conditionals, and -ForceMembershipRefresh), delivery-management changes, and create/delete of DDGs are deliberate changes. Change one filter or one attribute set at a time, preview before commit, wait for the documented population/refresh windows, and check current Microsoft Learn for lifecycle timing, which Microsoft updated for late May 2026.
Top comments (0)