User groups

While you can easily access all the groups in Entra ID or Exchange, MDCA does not automatically sync all of your groups, if you want to use a group as perhaps a filter on an activity policy you need to choose the group to import. I believe this is a limitation because at the time an activity is generated the "user groups" are added to the activity. Processing all of that information would cause problems, and doing it dynamically would make filtering the activities slow.

Imported user groups will update hourly, when updating only enabled accounts will be imported as part of the user group. These user groups are limited to 500 total, there does not appear to be a limit to the number of users within that group.

"Automatic" groups

There are three groups you are likely to have out of the box:

• Microsoft 365 administrator
• External users
• Application (Defender for Cloud Apps)

Other "automatic" groups you may have depending on your connected apps include:

• Dropbox administrator
• Google Workspace administrator
• Box administrator
• Various Salesforce roles and custom profiles