Create simpler, more efficient dynamic membership rules
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit a4a14c3 · +11 −1 lines · also on GitHub
⋯ 18 unchanged lines
1919
2020
## Minimize use of the -match operator
2121
22
−Minimize your use of the `-match` operator in rules as much as possible. Instead, explore if it's possible to use the `-startsWith`, `endsWith` or `-eq` operator. `-eq` is preferred when the full attribute value is known; `-startsWith` and `-endsWith` are next most efficient when only a prefix or suffix is known. Consider using other properties that allow you to write rules to select the users for a group without using the `-match` operator.
22
+Minimize your use of the `-match` operator in rules as much as possible. Instead, explore if it's possible to use the `-startsWith`, `-endsWith` or `-eq` operator. `-eq` is preferred when the full attribute value is known; `-startsWith` and `-endsWith` are next most efficient when only a prefix or suffix is known. Consider using other properties that allow you to write rules to select the users for a group without using the `-match` operator.
2323
2424
For example, if you want a rule for the group that contains all users whose city is Lagos, don't use a rule like these:
2525
⋯ 7 unchanged lines
3333
Or, best of all:
3434
3535
- `user.city -eq "Lagos"`
36
+
37
+Similarly, for email-domain rules, don't use:
38
+
39
+- user.mail -match ".*@Contoso\.com$"
40
+- user.mail -notMatch ".*@Contoso\.com$"
41
+
42
+It's better to use:
43
+
44
+- user.userPrincipalName -endsWith "@Contoso.com"
45
+- user.mail -notEndsWith "@Contoso.com"
3646
3747
## Minimize use of the -contains operator
3848
⋯ 43 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.