1. A method in a computing system for dynamically managing computer applications, comprising: receiving data containing application entitlements; receiving a plurality of group definitions, each of the group definitions expressing one or more group composition logic rules, wherein the one or more group composition logic rules of a group definition are used to identify members of a corresponding group, from a plurality of candidate member users, through evaluation of the one or more group composition logic rules; evaluating the one or more group composition logic rules of each of the group definitions to generate one or more data repository queries corresponding to the group, wherein the data repository queries for a particular group, when executed against candidate member users, determine which candidate members satisfy the respective group composition logic rules; causing the data repository queries to be executed against one or more data repositories and, in response, generating one or more tables that map users as members of one or more groups and map users to particular application entitlements assigned to the respective groups; determining one or more of a change to a user that changes the user's status relative to one or more group composition logic rules or a change to a group that changes one or more user's membership in the group; automatically propagating the received change including recalculating information in the one or more tables that map users as members to groups and map users to the application entitlements assigned to the respective groups; determining that a group is to be deleted; and moving the group composition logic rules from the determined group to be deleted into one or more of the group definitions that refer to the determined group to be deleted.