What can be used as match criteria for creating a dynamic address group?

MAC addresses are not typically used as direct match criteria for dynamic address groups, as they are layer 2 identifiers and not suitable for policy-based grouping in this manner.

While IP addresses are associated with network objects, dynamic address groups are not defined by a direct list of IP addresses but rather by attributes (like tags) that those IP addresses' hosts possess.

Usernames are used for User-ID based policies but not as direct match criteria for dynamic address groups, which focus on network objects.

Dynamic address groups (DAGs) in Palo Alto Networks firewalls use tags as their primary match criteria; network devices or virtual machines are tagged, and the DAG automatically includes all objects possessing the specified tags, providing flexibility and automation.