Dynamic Distribution Group Not Updating: A Read-First Recipient Filter, Preview, and Refresh Triage

Helpdesk: "Jordan changed departments yesterday and still gets every email to Sales-All. Priya started in Marketing two days ago and never appears on the Marketing DDG. Marcus says the group looks empty in EAC right after we created it. Can you just rebuild the dynamic distribution group, or force it to sync like an Entra dynamic group?"

Don't rebuild the DDG yet. Exchange Online dynamic distribution group "not updating" is usually one broken layer in a documented chain, not a missing sync button: you're looking at the wrong group type (Entra dynamic security / M365 group vs Exchange DDG) → the recipient filter doesn't match the attributes you think it does → preview and stored membership disagree because the list is still calculating or waiting on the 24-hour refresh → attribute sync / exact-match values are wrong → mail delivery is blocked even though membership is fine. Microsoft's manage-DDG, troubleshoot-membership, RecipientFilter, and Set-DynamicDistributionGroup articles are the sources for that chain — not a tip that says "delete and recreate."

If the real problem is an Entra ID dynamic security or Microsoft 365 group (membershipRule / memberOf), start with Entra Dynamic Group Not Updating. If people can't send as the group, use Send As Permission Not Working. If mail vanishes after it reaches Exchange, check Exchange Online Mail Flow Rule Not Working. This post covers "the Exchange Online dynamic distribution group's membership list is empty, stale, or wrong — or mail to it doesn't match who should be on it."

TL;DR

• Exchange DDGs are not Entra dynamic groups. Microsoft: DDG membership is calculated and stored, then refreshed at least once every 24 hours. DDGs are not synced from Exchange Online to Microsoft Entra ID, so Conditional Access and Entra-scoped features cannot target an EXO DDG.
• Preview the filter before you rebuild. Get-Recipient -RecipientPreviewFilter $ddg.RecipientFilter shows who matches the rules right now. Get-DynamicDistributionGroupMember shows the stored membership list used for delivery. If preview is right and members are wrong → timing / refresh. If preview is wrong → fix the filter or attributes.
• Lifecycle timing (document late May 2026 change): create or change rules with 5,000 or fewer matching members → membership populates / recalculates immediately; more than 5,000 → background process within up to 2 hours (during recalculation the DDG keeps the previous list). After that, every DDG refreshes at least once every 24 hours.
• Pre-canned filters require exact attribute values. Microsoft: Washington does not match WA. Text values aren't case-sensitive (Contoso matches contoso), but spelling and abbreviations must match the recipient property.
• Force refresh is a last read-backed step, not first aid. Set-DynamicDistributionGroup -ForceMembershipRefresh only after more than 1 hour since the last membership refresh, and only when create/recalc is past the documented windows or the 24-hour refresh was missed. PowerShell only — not in EAC.
• Membership ≠ delivery. Empty AcceptMessagesOnlyFrom lists, RequireSenderAuthenticationEnabled, moderation, and mail-flow rules can make "the group isn't working" look like a membership bug when the list is fine.

Where in the chain did it break?

Step 1: Capture the exact symptom (read-only)

Write four facts on the ticket before New-DynamicDistributionGroup or delete/recreate:

Then compare:

1. Does EAC → Recipients → Groups → Dynamic distribution list → Members → View all members show anyone?
2. Does Outlook expand the group (client GAL/cache) or only delivery fail?
3. Is the object under Dynamic distribution, or is it a Microsoft 365 group / distribution list / security group with mail?
4. Check Microsoft 365 Service Health for Exchange Online before you rewrite filters.

Step 2: Confirm it is an Exchange Online DDG (read-only)

Get-DynamicDistributionGroup -Identity 'sales-all@contoso.com' |
  Select-Object Name, PrimarySmtpAddress, RecipientTypeDetails, ManagedBy,
                RecipientFilter, IncludedRecipients, ConditionalCompany,
                ConditionalDepartment, ConditionalStateOrProvince,
                RecipientContainer, CalculatedMembershipUpdateTime,
                HiddenFromAddressListsEnabled, RequireSenderAuthenticationEnabled,
                ModerationEnabled

Microsoft documents explicitly: DDGs aren't synced from Exchange Online to Microsoft Entra ID or on-premises AD, so Azure Conditional Access cannot be scoped to an EXO DDG. If the ticket expected Entra-style "force processing," that control does not exist on this object.

ManagedBy (owners): EAC requires an owner at create time. In PowerShell, read ManagedBy (and -IncludeManagedByWithDisplayNames on Get when you need display names in EXO). Missing or wrong owners don't usually empty membership, but they block who can manage the group in EAC and who receives moderation fallbacks when moderators aren't set — capture owners before you change filters.

Step 3: Read the membership rules (read-only)

Two rule styles exist:

Microsoft warning for Exchange Online custom filters: a wildcard as a prefix (for example Property -like '*abc') is not supported for DDG recipient filters (performance). Prefer suffix/contains patterns Microsoft documents as supported, or exact -eq values.

Also note IncludedRecipients / recipient-type checkboxes (MailboxUsers, MailUsers, MailContacts, Resources, MailGroups, etc.). A perfect Department filter still returns nobody if you limited the group to the wrong recipient types.

RecipientContainer (scope): filters only evaluate recipients under that OU/container. Preview commands should use the same container when you compare (see Microsoft's Get-DynamicDistributionGroup example that passes -OrganizationalUnit $ddg.RecipientContainer).

$ddg = Get-DynamicDistributionGroup -Identity 'sales-all@contoso.com'
$ddg | Format-List Name, RecipientFilter, LdapRecipientFilter, IncludedRecipients,
  Conditional*, RecipientContainer, ManagedBy, CalculatedMembershipUpdateTime

LdapRecipientFilter is the LDAP form Exchange stores — useful when comparing hybrid/on-prem mental models, but edit via OPATH RecipientFilter / pre-canned parameters, not by hand-editing LDAP strings unless you know that path is supported in your scenario.

Step 4: Preview filter results vs stored members (read-only)

Microsoft's preview guidance (PowerShell only — not in EAC):

$ddg = Get-DynamicDistributionGroup -Identity 'sales-all@contoso.com'

# Who matches the rules right now (adjust ResultSize as needed):
Get-Recipient -RecipientPreviewFilter $ddg.RecipientFilter -ResultSize 100 |
  Select-Object DisplayName, PrimarySmtpAddress, RecipientTypeDetails, Department, Company

# If RecipientContainer is set, scope the preview the same way:
# Get-Recipient -RecipientPreviewFilter $ddg.RecipientFilter -OrganizationalUnit $ddg.RecipientContainer -ResultSize 100

# Stored membership list used for delivery / EAC members:
Get-DynamicDistributionGroupMember -Identity $ddg.Identity |
  Select-Object DisplayName, PrimarySmtpAddress, RecipientTypeDetails

Don't trust Outlook's expand-to-members UI as the source of truth for DDG membership. Client address books can lag; PowerShell preview + Get-DynamicDistributionGroupMember are the admin reads Microsoft documents.

Step 5: Read last refresh and respect the lifecycle (read-only, then optional force)

(Get-DynamicDistributionGroup -Identity 'sales-all@contoso.com').CalculatedMembershipUpdateTime

In EAC: Recipients → Groups → Dynamic distribution list — use the Last refreshed column.

Microsoft's membership lifecycle (hedge: these are documented operational windows, not a contractual minute-level SLA):

Implications Microsoft calls out:

• A user who leaves a matching department can keep receiving DDG mail until the next refresh.
• A user who newly matches may not receive DDG mail until the next refresh.
• Mail flow rules that depend on DDG membership use the same stored list, so they inherit the same staleness.

Force membership refresh (only when the windows above are already exceeded):

# Only after more than 1 hour since the last membership refresh (Microsoft note).
# Set-DynamicDistributionGroup -Identity 'sales-all@contoso.com' -ForceMembershipRefresh

Use force when: empty more than 2 hours after create; not recalculated more than 2 hours after a rule change; or not refreshed within the expected 24-hour interval. You cannot force refresh in EAC.

Step 6: Fix attributes and exact-match surprises (read-only first)

Pre-canned filters match exact property values. Microsoft's example: filter Washington does not match recipient WA. Text compares aren't case-sensitive.

# Confirm what Exchange sees on the user (not only what HR UI shows):
Get-Recipient -Identity 'priya@contoso.com' |
  Select-Object DisplayName, Department, Company, StateOrProvince,
                CustomAttribute1, CustomAttribute10, RecipientTypeDetails,
                Office, Title, RecipientOU

Get-User -Identity 'priya@contoso.com' |
  Select-Object Department, Company, StateOrProvince, CustomAttribute1

Hybrid note (hedged): cloud-only DDGs live in Exchange Online and are not written back to on-premises AD / Entra as group objects. On-premises Exchange DDGs are a different lifecycle (often evaluated differently than EXO's stored list model). If the ticket is "hybrid dynamic distribution group not syncing," separate where the DDG was created (on-prem vs EXO) from whether the user's attributes synced into the environment that hosts the filter. Don't delete the EXO DDG to "resync" it like an Entra Connect group.

Step 7: Membership vs delivery (read-only)

When Get-DynamicDistributionGroupMember looks right but users say "the group doesn't work," read delivery settings before touching the filter:

Get-DynamicDistributionGroup -Identity 'sales-all@contoso.com' |
  Select-Object Name, RequireSenderAuthenticationEnabled, ModeratedBy,
                ModerationEnabled, AcceptMessagesOnlyFrom,
                AcceptMessagesOnlyFromDLMembers, AcceptMessagesOnlyFromSendersOrMembers,
                RejectMessagesFromSendersOrMembers, HiddenFromAddressListsEnabled

Run a message trace for a failed send to the DDG address before rewriting RecipientFilter.

Send As / Send on Behalf on the DDG itself is a delegate problem, not membership — see Send As Permission Not Working.

Step 8: DDG vs Microsoft 365 groups — when not to rebuild

Rebuilding a DDG because someone expected Teams files or CA exclusion groups will not fix the ticket. Delete/recreate also risks SMTP address, Send As delegates, moderation, and allow-list settings you already verified.

Step 9: Change one thing (only after the read)

After preview, timestamp, and attribute checks agree on the layer:

# Example: correct a custom filter (PowerShell only for custom RecipientFilter).
# Preview the NEW filter string with Get-Recipient -RecipientPreviewFilter FIRST.
# Set-DynamicDistributionGroup -Identity 'sales-all@contoso.com' -RecipientFilter "(RecipientTypeDetails -eq 'UserMailbox') -and (Department -eq 'Sales')"

# Example: pre-canned department correction (EAC Members rules or):
# Set-DynamicDistributionGroup -Identity 'sales-all@contoso.com' -ConditionalDepartment 'Sales' -IncludedRecipients 'MailboxUsers'

# Example: force refresh only when Microsoft's wait windows are already exceeded:
# Set-DynamicDistributionGroup -Identity 'sales-all@contoso.com' -ForceMembershipRefresh

Retest:

1. Re-run Get-Recipient -RecipientPreviewFilter — does the intended set appear?
2. Check CalculatedMembershipUpdateTime and EAC Last refreshed.
3. Re-run Get-DynamicDistributionGroupMember after the documented immediate / ≤2 h window.
4. Send one test message from an allowed internal user; confirm delivery with message trace — don't use Outlook expand alone.

Microsoft note: you cannot replace a pre-canned filter with a custom OPATH filter (or the reverse) by casually flipping parameters — Set-DynamicDistributionGroup modifies the existing filter style. If you truly need to switch styles, plan a new DDG and a cutover; don't assume in-place conversion.

When a change is justified

FAQ

Why is my dynamic distribution group not updating?
In order of how often it happens in Exchange Online: the membership list is still within the create/recalc window or waiting on the 24-hour refresh; the RecipientFilter / pre-canned values don't exactly match recipient attributes; IncludedRecipients or RecipientContainer excludes the user; you're troubleshooting an Entra dynamic group by mistake; or delivery settings make a healthy membership look broken. Compare Get-Recipient -RecipientPreviewFilter to Get-DynamicDistributionGroupMember before rebuilds.

How do I force a dynamic distribution group to update?
Use Exchange Online PowerShell: Set-DynamicDistributionGroup -Identity <DDG> -ForceMembershipRefresh. Microsoft: only after more than one hour since the last membership refresh; not available in EAC. Prefer this when create/recalc exceeded ~2 hours or the 24-hour refresh was missed — not as the first response to a same-day department change.

What's the difference between preview and members?
Preview (Get-Recipient -RecipientPreviewFilter) evaluates who matches the rules now. Members (Get-DynamicDistributionGroupMember / EAC View all members) is the stored list Exchange uses for delivery until the next calculation/refresh. They can disagree on purpose during recalculation and between 24-hour refreshes.

Dynamic distribution group vs Entra dynamic group — which do I have?
If it appears under Exchange admin center Recipients → Groups → Dynamic distribution list and Get-DynamicDistributionGroup works, it's an Exchange DDG. If it has an Entra dynamic membership rule / membershipRule in Microsoft Entra admin center, use the Entra triage. DDGs do not sync to Entra for Conditional Access targeting.

Can I use a dynamic distribution group for Conditional Access or Intune?
No. Microsoft: DDGs aren't synced from Exchange Online to Microsoft Entra ID, so features like Azure Conditional Access don't support being scoped to an EXO DDG. Use an Entra security group (assigned or dynamic) for those workloads.

Related posts

• Entra Dynamic Group Not Updating (Entra membershipRule / memberOf — Step 8 there is the short Exchange DDG sidebar this post expands)
• Send As Permission Not Working (Send As / Send on Behalf on mailboxes and groups, including DDGs)
• Shared Mailbox Not Showing in Outlook (client visibility vs server-side membership)
• Does a Shared Mailbox Need a License? (EXO recipient limits adjacent to group design)
• Exchange Online Mail Flow Rule Not Working (when delivery fails after membership is correct; rules also consume the stored DDG list)
• A Monthly Exchange Online Hygiene Check (read-only EXO permission/forwarding inventory)

Free checklist

DDG membership tickets often land in the same week as a Conditional Access or MFA rollout, when "Sales-All is wrong" and "I can't sign in" share one queue. Before you enforce, the free Conditional Access pre-enforcement checklist keeps break-glass accounts, pilot groups, and report-only review on one page:

👉 https://cashflow4375.gumroad.com/l/ujkqxb?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=dynamic-distribution-group-not-updating

If you want the rest of the M365 admin runway written down for the team (break/fix cards, offboarding and mailbox decisions, and read-only PowerShell snapshots), the Intune & M365 Admin Starter Pack pairs with this triage: https://cashflow4375.gumroad.com/l/joonf?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=dynamic-distribution-group-not-updating

Admin Pack Studio; not affiliated with Microsoft. Steps 1–8 only read: EAC group properties, Get-DynamicDistributionGroup, Get-DynamicDistributionGroupMember, Get-Recipient -RecipientPreviewFilter, Get-Recipient / Get-User attribute checks, and message trace. Set-DynamicDistributionGroup (including -RecipientFilter, pre-canned conditionals, and -ForceMembershipRefresh), delivery-management changes, and create/delete of DDGs are deliberate changes. Change one filter or one attribute set at a time, preview before commit, wait for the documented population/refresh windows, and check current Microsoft Learn for lifecycle timing, which Microsoft updated for late May 2026.