Looking for a way to set up mail moderation using Entra dynamic group

In Entra-only environments, you need to separate two things: group membership logic and mail flow moderation.

FirSt, dynamic membership.

Entra dynamic groups do not rely on traditional on-prem Extension Attributes unless those attributes are synchronized and available in Entra. However, you are not limited to extensionAttribute fields. You can build dynamic membership rules using any supported Entra user property, such as department, jobTitle, companyName, userType, accountEnabled, or custom security attributes.

If your API integration cannot populate extension attributes, consider these alternatives:

Use native Entra attributes that your API can populate, such as department or jobTitle.

Use Custom Security Attributes in Entra, which are cloud-native and designed for structured classification scenarios.

Redesign the logic so that dynamic membership is based on standardized fields instead of extension attributes.

Second, mail moderation.

Dynamic Microsoft 365 Groups do not support mail moderation the same way dynamic distribution groups in Exchange do. If you need true mail moderation, you may need to:

Use a dynamic distribution group in Exchange Online (cloud-based)

Configure message moderation at the Exchange layer

In Exchange Online you can configure moderation using transport settings. For example, you can enable moderation on a group and define moderators without relying on extension attributes.

The key question is whether you need:

A) Dynamic membership with moderated mail flow

or

B) Controlled mail flow with rule-based transport restrictions

If the primary goal is to control mass internal emails, you may also consider using Exchange Online mail flow rules instead of group-based moderation. For example, you can create a transport rule that:

Detects large recipient counts

Detects specific sender attributes

Requires approval before delivery

Tis approach removes the dependency on extension attributes entirely.

Architecturally, in Entra-only environments, the recommended direction is:

Use Entra dynamic groups for identity-based grouping

Use Exchange Online transport rules or group moderation for mail governance

Avoid legacy extensionAttribute dependency when possible

One additional option, if your API is flexible, is to map your business classification into a standard Entra attribute instead of relying on extensionAttribute fields.

Before redesigning everything, I would clarify:

Are you using the dynamic distribution list primarily for recipient targeting, or primarily for mail control and approval?

The solution may differ depending on that answer.

Hi EPdata​, Before suggesting a direction, can I check a few details so the answer fits your setup?

1. Are you still running Exchange on‑prem in hybrid, or are all mailboxes and distribution lists already in Exchange Online?
2. ​In the target “Entra only” state, will Exchange Online remain your mail platform, or is mail also moving elsewhere?
3. Which HR / identity system and connector are you using, and is it truly unable to write any Exchange‑visible attributes (department, company, customAttribute1–15, directory extensions), or is that just not configured today?
4. ​Do you specifically need “moderated dynamic DLs”, or would moderated mail‑enabled security groups or Microsoft 365 Groups also satisfy the governance requirement?
   ​

Assuming you’re moving to Exchange Online as the sole mail platform, and decommissioning on‑prem Exchange, the usual pattern looks like this:

• Rebuild the dynamic logic in Exchange Online: Create dynamic distribution groups in Exchange Online (EAC or PowerShell) using attributes your new connector can populate: department, location, company or chosen customAttributes. ​These become your new “broadcast targets”, replacing the old on‑prem DDLs.
• ​Align provisioning with those rules: Configure the HR / Entra provisioning so it stamps the right attributes on users that Exchange can filter on. This might be standard attributes or directory extensions that sync through.
• Turn on moderation in Exchange Online: On those dynamic groups (or on mail‑enabled security / M365 groups), enable message approval using the Moderated recipients in Exchange Online feature in EAC or via Set-DistributionGroup / Set-DynamicDistributionGroup.
  ​

That way, Entra and your HR system drive who is in scope, and Exchange Online continues to handle moderation in a fully supported way.

Here are some references,
https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership
https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/moderated-recipients-exo/moderated-recipients-exo
https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/moderated-recipients-exo/configure-moderated-recipients-exo