Dynamic Security Group Syntax - Exclude Disabled Users

Question

Dynamic Security Group Syntax - Exclude Disabled Users

Dean Hoile 61

Hi,

I want to exclude all disabled users from a Dynamic Distribution Group but I am not sure of the syntax I would use.

This is the current syntax.

(user.country -eq "Gibraltar") or (user.country -eq "Hungary") or (user.country -eq "Isle of Man") or (user.country -eq "Malta")

I am trying to use

(user.country -eq "Gibraltar") or (user.country -eq "Hungary") or (user.country -eq "Isle of Man") or (user.country -eq "Malta") -and -not (user.accountEnabled -eq false) which is accepted but I am not seeing disabled users disappear from the list.

It's been around 30 minutes since I updated the Syntax in the rule, could I have it wrong?

Accepted answer

1 additional answer

Your answer

Answer 1

Dillon Silzer 57,826 Volunteer Moderator

Hi @Dean Hoile

You should correct this statement to:

((user.country -eq "Gibraltar") or (user.country -eq "Hungary") or (user.country -eq "Isle of Man") or (user.country -eq "Malta")) and (user.accountEnabled -eq false)

Then try the Validate Rules (preview)

-----------------------------------

If this is helpful please accept answer.

Dean Hoile 61 Reputation points

2022-09-13T18:10:48.037+00:00

Hi @Dillon Silzer

Thanks for the help!

I was attempting to use the rule validation tool (have used it in a previous job and worked) but I seem to be getting a permissions error in Azure AD when trying to validate a rule for a dynamic group.

The error is: insufficient privileges to update the membership rule for the group.

I have looked trough forums and posts but haven't seen any with this specific issue, I have GA access so there should be no issues with permissions as far as I can tell.

Also can't see the rule removing disabled users yet, still testing but any help will be very appreciated.
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2022-09-13T22:39:32.707+00:00

@Dean Hoile
Thank you for following up on this!

From your error message - insufficient privileges to update the membership rule for the group, can you double check your user's permission on the Overview tab of Azure AD? Please keep in mind that, assigning one of the required roles (Global Administrator, Groups Administrator, or Intune Administrator) via indirect group membership is not yet supported.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
David Ferguson 0 Reputation points

2023-09-27T00:51:31.7566667+00:00

If the goal is to exclude disabled accounts shouldn't the rule be:

((user.country -eq "Gibraltar") or (user.country -eq "Hungary") or (user.country -eq "Isle of Man") or (user.country -eq "Malta")) and (user.accountEnabled -eq true)

Answer 2

JamesTran-MSFT 36,906 Microsoft Employee Moderator

@Dean Hoile
Thank you for your post!

Adding onto what @Dillon Silzer mentioned, since you didn't see your Dynamic Security Group update after configuring the membership rules. You can definitely leverage the Validate a dynamic group membership rule (preview) feature to validate your dynamic rule, and confirm the rule is working as expected.

Please keep in mind that depending on the size of your Azure AD organization, the group may take up to 24 hours for populating for the first time or after a rule change. For more info - Troubleshooting dynamic memberships for groups.

(user.country -eq "Gibraltar") and (user.country -eq "Hungary") and (user.country -eq "Isle of Man") and (user.country -eq "Malta") and (user.accountEnabled -eq false)

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Dean Hoile 61 Reputation points

2022-09-14T07:30:09.433+00:00

Hi @JamesTran-MSFT

Thanks for the feedback and assistance.

So I tried to set this up in my 365 test environment and it works as expected (see image below) except that I used (user.country -eq "Gibraltar") or (user.country -eq "Hungary") or (user.country -eq "Isle of Man") or (user.country -eq "Malta") and (user.accountEnabled -eq true) and not (user.country -eq "Gibraltar") or (user.country -eq "Hungary") or (user.country -eq "Isle of Man") or (user.country -eq "Malta") and (user.accountEnabled -eq false)

So I believe it works but on my live 365 tenant it is not showing this behaviour. The users not in the group by the validation tool do not have a country set so did not get added to the group.
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2022-09-14T23:12:33.987+00:00

@Dean Hoile
Thank you for following up on this and for pointing out that you used Or, since I completely missed that!

When it comes to your 365 tenant not showing the same behavior as the Validate Rules page, can you share the details for one user where the behavior isn't working as expected?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2022-09-19T17:49:02.157+00:00

@Dean Hoile
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
Dean Hoile 61 Reputation points

2022-09-20T07:49:25.887+00:00

Hi @JamesTran-MSFT

Sorry for the delay, I have a case open with Microsoft now as none of my colleagues can use this feature and we have the required permissions.

Essentially we can't run the validate rules feature agains't any persons at all in our AAD tenant.

You can mark this as solved.
$Admin - Amir Terani 0 Reputation points

2023-03-17T21:20:49.4633333+00:00

@Dean Hoile , Did you ever resolve this with Microsoft? We are in the same boat!

Share via

Dynamic Security Group Syntax - Exclude Disabled Users

1 additional answer

Your answer