"Where Used" displays only static parent groups while "View Related Groups" displays both static and dynamic parents in NSX

Products

• VMware NSX

Issue/Introduction

• When evaluating a child Group object in NSX Inventory, there is a discrepancy between the outputs of the "Where Used" and "View Related Groups" queries.
• If a child group is added to one parent group statically, and simultaneously matches the dynamic membership criteria of another parent group, the "Where Used" tab only lists the static parent group. However, "View Related Groups" lists both the static and dynamic parent groups.

Symptoms/Reproduction Steps:

1. Create a child group (e.g., ip-child-group) as an IP Address only group and assign a tag and scope (e.g., tag: t1, scope: s1).

2. Create a static parent group (e.g., parent-static-gp) and explicitly select the ip-child-group as a member.

3. Create a dynamic parent group (e.g., dynamic-parent-gp) with a Condition Expression to match IP Address based groups with tag t1 and scope s1.

4. Observe the "Where Used" output of the child group: Only parent-static-gp is displayed.

5. Observe the "View Related Groups" output of the child group: Both parent-static-gp and dynamic-parent-gp are displayed.

Environment

VMware NSX

Cause

This is an expected behavior within NSX.

The NSX Central Control Plane (CCP) dynamically evaluates and resolves group members, which populates the effective membership seen in "View Related Groups".
However, the search mechanism utilized by the "Where Used" function queries the management plane database specifically for static membership references and explicit object relationships. Because the dynamic parent group relies on condition expressions rather than a static configuration mapping, it is not returned in the "Where Used" output.

Where used API call: GET /policy/api/v1/search/aggregate
View Related Groups: GET /policy/api/v1/infra/group-associations

Resolution

No resolution is required as this functions by design.

When assessing the full dependency tree of a group—especially in environments heavily utilizing dynamic condition expressions—rely on the "View Related Groups" output to accurately observe dynamically resolved effective memberships.

Additional Information

If unexpected group association behavior is observed during troubleshooting, verify the Group condition expressions in the environment. For further assistance from Support, export and share the API Group definitions for all involved objects.

NSX-T Data Center REST API