Dynamic Unified group

Question

Hi All i want to create dynamic unified group. i have a department attribute synced to Azure AD. i have a department with name 9999 IT Support i want to create a dynamic unified group for this department and also i want to add 2 static users to this unified group. Will the below syntax work for me and how do i add static users to this unified group. for example i have john.abc1@Company portal .com and tom.123@Company portal .com (user.accountEnabled -eq true) -and ((user.department -startsWith "9999") or (user.samaccountname -eq "john.abc1") or (user.samaccountname -eq "tom.123"))

Answer 1

Hi @Glenn Maxwell

You may consider using below command in AD powershell

Get-ADUser -Filter {department -like '9999*' -or samaccountname -eq 'john.abc1' -or samaccountname -eq 'tom.123'} | Where { $_.Enabled -eq $True} | Select DisplayName,Userprincipalname,title,Office,description,co,DepartmentNumber,employeeNumber | Export-csv C:\test\groupmember.csv -Notypeinformation

In addition, Azure Active Directory (Azure AD) now provides the means to validate dynamic group rules (in public preview). On the Validate rules tab, you can validate your dynamic rule against sample group members to confirm the rule is working as expected. When creating or updating dynamic group rules, administrators want to know whether a user or a device will be a member of the group. This helps evaluate whether user or device meets the rule criteria and aid in troubleshooting when membership is not expected.

Detailed steps here: Validate a dynamic group membership rule (preview) in Azure Active Directory

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
 

Answer 2

Hi @Glenn Maxwell

The syntax below should work for you.

user.accountEnabled -eq true -and (user.department -startsWith "9999" -or user.samaccountname -eq "john.abc1" -or user.samaccountname -eq "tom.123")

Here is the official document about Dynamic membership rules for groups in Azure Active Directory for your reference as well

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
 

Answer 3

Before converting to dynamic unified group how can i validate this query. do i need to check this from Azure AD powershell. if so how do i check to know what users this query is fetching.

user.accountEnabled -eq true -and (user.department -startsWith "9999" -or user.samaccountname -eq "john.abc1" -or user.samaccountname -eq "tom.123")

i want to test something like this butnot sure how to do it.

$Test = "user.accountEnabled -eq true -and (user.department -startsWith "9999" -or user.samaccountname -eq "john.abc1" -or user.samaccountname -eq "tom.123")"
Get-ADUser -Filter $Test -Properties DisplayName,Userprincipalname,title,Office,description,co,DepartmentNumber,employeeNumber | Select DisplayName,Userprincipalname,title,Office,description,co,DepartmentNumber,employeeNumber | Export-csv C:\output.csv -Notypeinformation

Answer 4

Before converting unified group to dynamic unified group i want to test the same query in Azure AD PowerShell

i will use the below query to convert to dynamic unified group and the same query i want to test in Azure AD powershell. in Onprem Active Directory i can test it but i want to test in Azure AD since the syntaxes are different in onprem AD and Azure AD.

user.accountEnabled -eq true -and (user.department -startsWith "9999" -or user.samaccountname -eq "john.abc1" -or user.samaccountname -eq "tom.123")

$Test = "user.accountEnabled -eq true -and (user.department -startsWith "9999" -or user.samaccountname -eq "john.abc1" -or user.samaccountname -eq "tom.123")"
Get-ADUser -Filter $Test -Properties DisplayName,Userprincipalname,title,Office,description,co,DepartmentNumber,employeeNumber | Select DisplayName,Userprincipalname,title,Office,description,co,DepartmentNumber,employeeNumber | Export-csv C:\output.csv -Notypeinformation

2. user.samaccountname is this supported in the query i doubt?