Entra dynamic membership rules and the memberOf operator

This page's changes and edits · All guidance changes

Microsoft's edit · 16 Jun 19:30 UTC

Address dynamic membership audit findings

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 3258b02 · +8 −6 lines · also on GitHub

⋯ 133 unchanged lines

134134 | `jobTitle` |Any string value or `null` | ```user.jobTitle -eq "value"``` |

135135 | `mail` |Any string value or `null` (SMTP address of the user) | ```user.mail -eq "value"``` ```user.mail -notEndsWith "@Contoso.com"``` |

136136 | `mailNickName` |Any string value (mail alias of the user) | ```user.mailNickName -eq "value"``` ```user.mailNickname -endsWith "-vendor"``` |

137 −| `memberOf` | Array of strings (group object GUIDs) | ```user.memberOf -any (group.objectId -in ['value'])``` |

138137 | `mobile` |Any string value or `null` | ```user.mobile -eq "value"```|

139138 | `objectId` |GUID of the user object | ```user.objectId -eq "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb"```|

140139 | `onPremisesDistinguishedName` | Any string value or `null` | ```user.onPremisesDistinguishedName -eq "value"```|

⋯ 15 unchanged lines

156155

157156 | Property | Allowed values | Examples |

158157 | --- | --- | --- |

158 +| `memberOf` (preview) | Collection of strings (group object IDs) | ```user.memberOf -any (group.objectId -in ['value'])``` |

159159 | `otherMails` |Any string value | ```(user.otherMails -any (_ -startsWith "alias@domain"))``` ```(user.otherMails -any (_ -endsWith "@contoso.com"))``` |

160160 | `proxyAddresses` |`SMTP: alias@domain`, `smtp: alias@domain` | ```(user.proxyAddresses -any (_ -startsWith "SMTP: alias@domain"))``` ```(user.proxyAddresses -any (_ -notEndsWith "@outlook.com"))``` |

161161

⋯ 154 unchanged lines

316316

317317 `assignedPlans` is a multi-value property that lists all service plans assigned to the user. Service plans aren't the same as licenses or products. For more information, see [Product names and service plan identifiers for licensing](/entra/identity/users/licensing-service-plan-reference).

318318

319 −To find the service plan IDs assigned to a user, use Microsoft Graph PowerShell with the `Organization.Read.All` permission:

319 +To find the service plan IDs assigned to a user, use Microsoft Graph PowerShell with the `User.Read.All` permission:

320320

321321 ```powershell

322 −Get-MgUser -UserId [email protected] -Property assignedPlans |

322 +Connect-MgGraph -Scopes 'User.Read.All'

323 +

324 +Get-MgUser -UserId [email protected] -Property assignedPlans |

323325 Select-Object -ExpandProperty assignedPlans |

324326 Select-Object service, servicePlanId, capabilityStatus | Format-List

325327 ```

⋯ 4 unchanged lines

330332 user.assignedPlans -any (assignedPlan.servicePlanId -eq "efb87545-963c-4e0d-99df-69c6916d9eb0" -and assignedPlan.capabilityStatus -eq "Enabled")

331333 ```

332334

333 −The `assignedPlan.capabilityStatus` parameter is required for the query to work.

335 +Include `assignedPlan.capabilityStatus -eq "Enabled"` when you want the rule to match only users whose service plan is enabled.

334336

335337 You can use a rule like this one to group all users for whom a Microsoft 365 or other Microsoft Online Services capability is enabled. You could then apply the rule with a set of policies to the group.

336338

⋯ 114 unchanged lines

451453

452454 ## Rules for devices

453455

454 −You can create a rule that selects device objects for membership in a group. You can't have both users and devices as group members. If you use Intune, consider using assignment filters when possible because they apply to existing groups. For more information, see [Use filters when assigning your apps, policies, and profiles in Microsoft Intune](/intune/intune-service/fundamentals/filters).

456 +You can create a rule that selects device objects for membership in a group. You can't have both users and devices as group members. For Intune app and policy assignments, use assignment filters when they meet the targeting need. Filters include or exclude managed devices or apps within an assigned group. Use dynamic groups for non-Intune or cross-workload scenarios, such as Conditional Access, licensing, or Autopilot profile assignment. For more information, see [Create assignment filters in Microsoft Intune](/intune/fundamentals/filters/overview).

455457

456458 > [!NOTE]

457459 > The `organizationalUnit` attribute is no longer listed, and you shouldn't use it. Intune sets this string in specific cases, but Microsoft Entra ID doesn't recognize it. No devices are added to groups based on this attribute.

⋯ 42 unchanged lines

500502 | `extensionAttribute15` | Any string value | `device.extensionAttribute15 -eq "some string value"` |

501503 | `isRooted` | `true`, `false` | `device.isRooted -eq true` |

502504 | `managementType` | Mobile device management (for mobile devices) | `device.managementType -eq "MDM"` |

503 − | `memberOf` | Any string value (valid group object ID) | `device.memberOf -any (group.objectId -in ['value'])` |

505 + | `memberOf` (preview) | Collection of strings (group object IDs) | `device.memberOf -any (group.objectId -in ['value'])` |

504506 | `objectId` | A valid Microsoft Entra object ID | `device.objectId -eq "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb"` |

505507 | `profileType` | A valid [profile type](/graph/api/resources/device?view=graph-rest-1.0&preserve-view=true#properties) in Microsoft Entra ID | `device.profileType -eq "RegisteredDevice"` |

506508 | `systemLabels`4 | A read-only string that matches the Intune device property for tagging Modern Workplace devices | `device.systemLabels -startsWith "M365Managed" SystemLabels` |

⋯ 16 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.