Entra dynamic membership rules and the memberOf operator
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 8018efd · +21 −23 lines · also on GitHub
⋯ 125 unchanged lines
126126
| `mobile` |Any string value or `null` | ```user.mobile -eq "value"```|
127127
| `objectId` |GUID of the user object | ```user.objectId -eq "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb"```|
128128
| `onPremisesDistinguishedName` | Any string value or `null` | ```user.onPremisesDistinguishedName -eq "value"```|
129
−| `onPremisesSecurityIdentifier` | On-premises security identifier (SID) for users who were synchronized from on-premises to the cloud. | ```user.onPremisesSecurityIdentifier -eq "S-1-1-11-1111111111-1111111111-1111111111-1111111"``` |
129
+| `onPremisesSecurityIdentifier` | On-premises security identifier (SID) for users who were synchronized from on-premises to the cloud | ```user.onPremisesSecurityIdentifier -eq "S-1-1-11-1111111111-1111111111-1111111111-1111111"``` |
130130
| `passwordPolicies` |`None`, `DisableStrongPassword`, `DisablePasswordExpiration`, `DisablePasswordExpiration`, `DisableStrongPassword` | ```user.passwordPolicies -eq "DisableStrongPassword"``` |
131131
| `physicalDeliveryOfficeName` |Any string value or `null` | ```user.physicalDeliveryOfficeName -eq "value"``` |
132132
| `postalCode` |Any string value or `null` | ```user.postalCode -eq "value"``` |
⋯ 21 unchanged lines
154154
The following table lists all the supported operators and their syntax for a single expression. You can use operators with or without the hyphen (`-`) prefix. The `Contains` operator does partial string matches but not matches for items in a collection.
155155
156156
> [!CAUTION]
157
−> For best results, minimize the use of `Match` or `Contains` as much as possible. The article [Create simpler, more efficient rules for dynamic membership groups](groups-dynamic-rule-more-efficient.md) provides guidance on how to create rules that result in better dynamic group processing times. The [`memberOf`](groups-dynamic-rule-member-of.md) operator is in preview and should be used with caution, because it has some limitations.
157
+> For best results, minimize the use of `Match` or `Contains` as much as possible. The article [Create simpler, more efficient rules for dynamic membership groups](groups-dynamic-rule-more-efficient.md) provides guidance on how to create rules that result in better dynamic group processing times. The [`memberOf`](groups-dynamic-rule-member-of.md) operator is in preview and has some limitations, so use it with caution.
158158
159159
| Operator | Syntax |
160160
| --- | --- |
⋯ 14 unchanged lines
175175
176176
If you want to compare the value of a user attribute against multiple values, you can use the `-in` or `-notIn` operator. Use the bracket symbols (`[` and `]`) to begin and end the list of values.
177177
178
− In the following example, the expression evaluates to `true` if the value of `user.department` equals any of the values in the list:
178
+In the following example, the expression evaluates to `true` if the value of `user.department` equals any of the values in the list:
179179
180180
```
181181
user.department -in ["50001","50002","50003","50005","50006","50007","50008","50016","50020","50024","50038","50039","51100"]
⋯ 3 unchanged lines
185185
186186
You can use the less than (`-le`) or greater than (`-ge`) operator when you're using the `employeeHireDate` attribute in rules for dynamic membership groups.
187187
188
−Examples:
188
+Here are examples:
189189
190190
```
191
−user.employeehiredate -ge system.now -plus p1d
192
−```
191
+user.employeehiredate -ge system.now -plus p1d
193192
194
−```
195193
user.employeehiredate -le 2020-06-10T18:13:20Z
196194
197195
```
⋯ 2 unchanged lines
200198
201199
You can use the `-match` operator for matching any regular expression.
202200
203
−Examples:
201
+For the following example, `Da`, `Dav`, and `David` evaluate to `true`. `aDa` evaluates to `false`.
204202
205203
```
206204
user.displayName -match "^Da.*"
207205
```
208206
209
−`Da`, `Dav`, and `David` evaluate to `true`. `aDa` evaluates to `false`.
207
+For the following example, `David` evaluates to `true`. `Da` evaluates to `false`.
210208
211209
```
212210
user.displayName -match ".*vid"
213211
```
214212
215
−`David` evaluates to `true`. `Da` evaluates to `false`.
216
−
217213
### Supported values
218214
219
−The values that you use in an expression can consist of several types, including:
215
+The values that you use in an expression can consist of several types:
220216
221217
- Strings
222218
- Boolean (`true`, `false`)
223219
- Numbers
224220
- Arrays (number array, string array)
225221
226
−When you specify a value within an expression, it's important to use the correct syntax to avoid errors. Some syntax tips are:
222
+When you specify a value within an expression, it's important to use the correct syntax to avoid errors. Here are some syntax tips:
227223
228224
- Double quotation marks are optional unless the value is a string.
229225
- Regex and string operations aren't case sensitive.
⋯ 3 unchanged lines
233229
234230
#### Use of null values
235231
236
−To specify a null value in a rule, you can use the `null` value:
232
+To specify a `null` value in a rule:
237233
238234
- Use `-eq` or `-ne` when you're comparing the `null` value in an expression.
239235
- Use quotation marks around the word `null` only if you want it to be interpreted as a literal string value.
240
−- You can't use the `-not` operator as a comparative operator for the null value. If you use it, you get an error whether you use `null` or `$null`.
236
+- Don't use the `-not` operator as a comparative operator for the null value. If you use it, you get an error whether you use `null` or `$null`.
241237
242
−The correct way to reference the null value is as follows:
238
+The correct way to reference the `null` value is as follows:
243239
244240
```
245241
user.mail –ne null
⋯ 53 unchanged lines
299295
300296
#### Using the -any and -all operators
301297
302
−You can use these operators to apply a condition to one or all of the items in the collection:
298
+You can use the following operators to apply a condition to one or all of the items in the collection:
303299
304300
- `-any`: Satisfied when at least one item in the collection matches the condition.
305301
- `-all`: Satisfied when all items in the collection match the condition.
⋯ 10 unchanged lines
316312
317313
##### Example 2
318314
319
−The following expression selects all users who have any service plan that's associated with the Intune service (identified by service name `SCO`):
315
+The following expression selects all users who have any service plan that's associated with the Intune service (identified by the service name `SCO`):
320316
321317
```
322318
user.assignedPlans -any (assignedPlan.service -eq "SCO" -and assignedPlan.capabilityStatus -eq "Enabled")
⋯ 39 unchanged lines
362358
363359
- The *manager ID* is the object ID of the manager. You can find it in the manager's profile.
364360
- For the rule to work, make sure that the `Manager` property is set correctly for users in your organization. You can check the current value in the user's profile.
365
−- This rule supports only the manager's direct reports. In other words, you can't create a group that has the manager's direct reports *and* their reports.
361
+- This rule supports only the manager's direct reports. You can't create a group that has the manager's direct reports *and* their reports.
366362
- You can't combine this rule with any other membership rules.
367363
368364
#### Create a rule for all users
⋯ 24 unchanged lines
393389
394390
### Extension attributes and custom extension properties
395391
396
−Extension attributes and custom extension properties are supported as string properties in rules for dynamic membership groups. You can sync [extension attributes](/graph/api/resources/onpremisesextensionattributes) from on-premises Windows Server Active Directory. Or you can update extension attributes by using Microsoft Graph.
392
+Extension attributes and custom extension properties are supported as string properties in rules for dynamic membership groups.
397393
394
+You can [sync extension attributes](/graph/api/resources/onpremisesextensionattributes) from on-premises Windows Server Active Directory. Or you can update extension attributes by using Microsoft Graph.
395
+
398396
Extension attributes take the format of `ExtensionAttribute<X>`, where `<X>` equals `1`-`15`. Multi-value extension properties aren't supported in rules for dynamic membership groups.
399397
400398
Here's an example of a rule that uses an extension attribute as a property:
⋯ 2 unchanged lines
403401
(user.extensionAttribute15 -eq "Marketing")
404402
```
405403
406
−You can sync [custom extension properties](~/identity/hybrid/connect/how-to-connect-sync-feature-directory-extensions.md) from on-premises Windows Server Active Directory or from a connected software as a service (SaaS) application. You can create custom extension properties by using Microsoft Graph.
404
+You can [sync custom extension properties](~/identity/hybrid/connect/how-to-connect-sync-feature-directory-extensions.md) from on-premises Windows Server Active Directory or from a connected software as a service (SaaS) application. You can create custom extension properties by using Microsoft Graph.
407405
408406
Custom extension properties take the format of `user.extension_[GUID]_[Attribute]`, where:
409407
⋯ 36 unchanged lines
446444
| `accountEnabled` | `true`, `false` | `device.accountEnabled -eq true` |
447445
| `deviceCategory` | A valid device category name | `device.deviceCategory -eq "BYOD"` |
448446
| `deviceId` | A valid Microsoft Entra device ID | `device.deviceId -eq "d4fe7726-5966-431c-b3b8-cddc8fdb717d"` |
449
− | `deviceManagementAppId` | A valid mobile device management (MDM) application ID in Microsoft Entra ID | `device.deviceManagementAppId -eq "0000000a-0000-0000-c000-000000000000"` for Microsoft Intune managed devices<br><br>`"54b943f8-d761-4f8d-951e-9cea1846db5a"` for System Center Configuration Manager co-managed devices |
447
+ | `deviceManagementAppId` | A valid application ID for mobile device management in Microsoft Entra ID | `device.deviceManagementAppId -eq "0000000a-0000-0000-c000-000000000000"` for Microsoft Intune managed devices<br><br>`"54b943f8-d761-4f8d-951e-9cea1846db5a"` for System Center Configuration Manager co-managed devices |
450448
| `deviceManufacturer` | Any string value | `device.deviceManufacturer -eq "Samsung"` |
451449
| `deviceModel` | Any string value | `device.deviceModel -eq "iPad Air"` |
452450
| `displayName` | Any string value | `device.displayName -eq "Rob iPhone"` |
⋯ 19 unchanged lines
472470
| `extensionAttribute14` | Any string value | `device.extensionAttribute14 -eq "some string value"` |
473471
| `extensionAttribute15` | Any string value | `device.extensionAttribute15 -eq "some string value"` |
474472
| `isRooted` | `true`, `false` | `device.isRooted -eq true` |
475
− | `managementType` | MDM (for mobile devices) | `device.managementType -eq "MDM"` |
473
+ | `managementType` | Mobile device management (for mobile devices) | `device.managementType -eq "MDM"` |
476474
| `memberOf` | Any string value (valid group object ID) | `device.memberOf -any (group.objectId -in ['value'])` |
477475
| `objectId` | A valid Microsoft Entra object ID | `device.objectId -eq "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb"` |
478476
| `profileType` | A valid [profile type](/graph/api/resources/device?view=graph-rest-1.0&preserve-view=true#properties) in Microsoft Entra ID | `device.profileType -eq "RegisteredDevice"` |
⋯ 17 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.