Device Group not in specific groups

Question

I am trying to archive a dynamic group with all members which are not in few other dynamic groups (guids below)
I can't create the rule syntax right.

This works:

device.memberof -any (group.objectId -in ['2ea9fcc0-558a-417d-b3c2-5d120eec3344', '93f74880-de12-42c0-a030-48efcef869f2', 'f4ab0800-55a0-4608-9f80-c4dbf32ec1c7'])

But if I try to change -any or -in to -notIn or -not, validation will fail.

Answer 1

Hello @Pavel yannara Mirochnitchenko

Thank you for being patient while I was trying to reproduce this issue. I found that device.memberof or user.memberof is specifically designed to create dynamic groups that populate by adding members of other groups. As of today, rule editor does not support -notIn or -not for memberOf attribute. We validate this from AAD response when creating a rule with -notIn operator for memberOf attribute.

You can refer following screenshot which shows the error message when you try to validate or save the rule device.memberof -any (group.objectId -notIn ['2272dd76-71ee-465f-902f-cefa8f30c4a0'])

For more information you can refer following documentation links:

Group membership in a dynamic group (preview) in Azure Active Directory: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-rule-member-of
Dynamic membership rules for groups in Azure Active Directory: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership

I hope this helps and resolves your query.

----------

Please "Accept the answer" if it helped you. This will help us and others in the community as well.