Azure AD Dynamic Group for Users without an Assigned Plan

Jay Burke 1 Reputation point


I am trying to create a Dynamic User Azure Ad Group where one of the conditions is that users do not have a specific assigned plan.

Here is my syntax but from the results it does not seem to be working as hoped:

(user.accountEnabled -eq True) and (user.extensionAttribute1 -contains "requireEmail") and (user.userPrincipalName -contains "") and (user.onPremisesDistinguishedName -contains "Managed") and (user.assignedPlans -any (assignedPlan.servicePlanId -ne "e97c048c-37a4-45fb-ab50-922fbf07a370" -and assignedPlan.capabilityStatus -eq "Enabled"))

Any help much appreicated.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
17,584 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Cristian SPIRIDON 4,471 Reputation points


    To use dynamic groups every user in the group must have at least Azure P1 license:

    See the Note from the beginning of the doc.

    Does every user that will belong to the group have at least Azure P1?

    Hope this helps!