Dynamic membership rules expressions

Question

I have added an expression inside of a security group in Entra ID, to member only active users with attributes in exchange (others) equal to E or C but it is not working. IT matches correctly the E or C attribute but still members user who are disabled:

(user.accountEnabled -eq True) and (user.extensionAttribute1 -contains "E") or (user.extensionAttribute1 -contains "C") What would be the right expression so the dynamic groups don't take disabled users and take only accounts with certain attributes?

Answer 1

Hello @Flavia , in order to make your Azure AD Dynamic Group matches users whose account are enabled and one of other or expressions you need to enclose the or expressions in parentheses. Eg:

(user.accountEnabled -eq True) and ((user.extensionAttribute1 -contains "E") or (user.extensionAttribute1 -contains "C"))

Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.