Entra dynamic membership rules and the memberOf operator

This page's changes and edits · All guidance changes

Microsoft's edit · 16 Jun 19:13 UTC

Clarify assignedPlans dynamic membership guidance

Microsoft's commit message in MicrosoftDocs/entra-docs · commit ed0d7d3 · +15 −3 lines · also on GitHub

⋯ 133 unchanged lines

134134 | `jobTitle` |Any string value or `null` | ```user.jobTitle -eq "value"``` |

135135 | `mail` |Any string value or `null` (SMTP address of the user) | ```user.mail -eq "value"```<br><br>```user.mail -notEndsWith "@Contoso.com"``` |

136136 | `mailNickName` |Any string value (mail alias of the user) | ```user.mailNickName -eq "value"```<br><br>```user.mailNickname -endsWith "-vendor"``` |

137 −| `memberOf` | Any string value (valid group object ID) | ```user.memberOf -any (group.objectId -in ['value'])``` |

137 +| `memberOf` | Array of strings (group object GUIDs) | ```user.memberOf -any (group.objectId -in ['value'])``` |

138138 | `mobile` |Any string value or `null` | ```user.mobile -eq "value"```|

139139 | `objectId` |GUID of the user object | ```user.objectId -eq "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb"```|

140140 | `onPremisesDistinguishedName` | Any string value or `null` | ```user.onPremisesDistinguishedName -eq "value"```|

⋯ 173 unchanged lines

314314

315315 ##### Example 1

316316

317 −`assignedPlans` is a multi-value property that lists all service plans assigned to the user. The following expression selects users who have the Exchange Online (Plan 2) service plan (as a GUID value) that's also in an `Enabled` state:

317 +`assignedPlans` is a multi-value property that lists all service plans assigned to the user. Service plans aren't the same as licenses or products. For more information, see [Product names and service plan identifiers for licensing](/entra/identity/users/licensing-service-plan-reference).

318318

319 +To find the service plan IDs assigned to a user, use Microsoft Graph PowerShell with the `Organization.Read.All` permission:

320 +

321 +```powershell

322 +Get-MgUser -UserId [email protected] -Property assignedPlans |

323 + Select-Object -ExpandProperty assignedPlans |

324 + Select-Object service, servicePlanId, capabilityStatus | Format-List

319325 ```

326 +

327 +The following expression selects users who have the Exchange Online (Plan 2) service plan, as a GUID value, that's also in an `Enabled` state:

328 +

329 +```

320330 user.assignedPlans -any (assignedPlan.servicePlanId -eq "efb87545-963c-4e0d-99df-69c6916d9eb0" -and assignedPlan.capabilityStatus -eq "Enabled")

321331 ```

322332

333 +The `assignedPlan.capabilityStatus` parameter is required for the query to work.

334 +

323335 You can use a rule like this one to group all users for whom a Microsoft 365 or other Microsoft Online Services capability is enabled. You could then apply the rule with a set of policies to the group.

324336

325337 ##### Example 2

⋯ 113 unchanged lines

439451

440452 ## Rules for devices

441453

442 −You can create a rule that selects device objects for membership in a group. You can't have both users and devices as group members.

454 +You can create a rule that selects device objects for membership in a group. You can't have both users and devices as group members. If you use Intune, consider using assignment filters when possible because they apply to existing groups. For more information, see [Use filters when assigning your apps, policies, and profiles in Microsoft Intune](/intune/intune-service/fundamentals/filters).

443455

444456 > [!NOTE]

445457 > The `organizationalUnit` attribute is no longer listed, and you shouldn't use it. Intune sets this string in specific cases, but Microsoft Entra ID doesn't recognize it. No devices are added to groups based on this attribute.

⋯ 65 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.