A method for dynamically creating service groups on a network element through use of an authentication, authorization, and accounting, AAA, server, the method comprising the steps of: receiving a first request for a first subscriber session from a first subscriber end station of a first subscriber, wherein the first subscriber session represents a distinguishable flow of packets being communicated between the first subscriber end station and the network element; transmitting an authentication request to the AAA server for the first subscriber session; receiving an authentication reply from the AAA server, the authentication reply including dynamic service group configuration information that indicates that the first subscriber session should be part of a service group and includes service group attribute information and instructions to derive a dynamic service group identifier; deriving a dynamic service group identifier from subscriber session attributes associated with the first subscriber session according to the instructions in the dynamic service group configuration information; and responsive to determining that a service group matching the service group attribute information and the dynamic service group identifier does not exist, performing the following steps: dynamically creating a service group according to the service group attribute information and the dynamic service group identifier, wherein the dynamically created service group is associated with a set of one or more service group attributes corresponding to the service group attribute information, and dynamically joining the first subscriber session to the dynamically created circuit group such that the set of service group attributes are applied to the first subscriber session, whereby manual creation of the service group and manual joining of the subscriber session to that service group are avoided. receiving a first request for a first subscriber session from a first subscriber end station of a first subscriber, wherein the first subscriber session represents a distinguishable flow of packets being communicated between the first subscriber end station and the network element; transmitting an authentication request to the AAA server for the first subscriber session; receiving an authentication reply from the AAA server, the authentication reply including dynamic service group configuration information that indicates that the first subscriber session should be part of a service group and includes service group attribute information and instructions to derive a dynamic service group identifier; deriving a dynamic service group identifier from subscriber session attributes associated with the first subscriber session according to the instructions in the dynamic service group configuration information; and responsive to determining that a service group matching the service group attribute information and the dynamic service group identifier does not exist, performing the following steps: dynamically creating a service group according to the service group attribute information and the dynamic service group identifier, wherein the dynamically created service group is associated with a set of one or more service group attributes corresponding to the service group attribute information, and dynamically joining the first subscriber session to the dynamically created circuit group such that the set of service group attributes are applied to the first subscriber session, whereby manual creation of the service group and manual joining of the subscriber session to that service group are avoided. dynamically creating a service group according to the service group attribute information and the dynamic service group identifier, wherein the dynamically created service group is associated with a set of one or more service group attributes corresponding to the service group attribute information, and dynamically joining the first subscriber session to the dynamically created circuit group such that the set of service group attributes are applied to the first subscriber session, whereby manual creation of the service group and manual joining of the subscriber session to that service group are avoided.