I struggled to get the Unauthorized Change Detection feature to work, so I contacted my internal colleagues.

@Bill Iffland was able to identify the missing piece, which is a dependency on service mapping.

So, it appears that a dynamic CI group is simply not enough for this feature to work. We had to create a manual service map.

It is unclear to me why this dependence exists, but it does...

I've posted a short video that will hopefully help anyone who is thinking of implementing this feature.

https://www.youtube.com/watch?v=Hg6HScjHLR8&list=PL5DgOfLBA3RanN94xRB4tZGY6aoKeFM%5Fb&index=3