dynamic membership rule

Question

dynamic membership rule

Rising Flight 3,161

Hi All

We are using exchange 2016 hybrid environment, we create users in onprem and migrate to online. In Azure AD I can see Office location for the users i.e it is synced from onprem to azure AD.

I want to create dynamic unified group for one office location lets say office location is abc. In abc location, some users have office location as abc and for some users office location is remote, abc. I want pull users with office location abc and abc, remote. In Azure AD for the unified group, under dynamic membership rules i want to try the below queries but i am not sure, please guide me.

(user.Office location -eq "*abc*") -or (user.Office location -eq "*abc*" and "*remote*" )

(user.Office location -contains "*abc*") -or (user.Office location -eq "*abc*" and "*remote*" )

I am only looking for key words abc ,remote, after abc or before abc, after remote or before remote it can be anything.

Rich Matheisen 43,076 Reputation points

2023-10-27T20:09:25.0833333+00:00

Do you really mean that you want to create a unified group? Or do you want to create a Dynamic Distribution group that will allow you to send email to one group whose membership includes users from locations "abc" and "abc, remote"?

Those are two different types of groups, and a unified group can exist only in the cloud service.
Rising Flight 3,161 Reputation points

2023-10-28T01:02:49.3933333+00:00

i have created unified group-->In Azure AD for the group properties-->Membership type: Dynamic User-->Add dynamic query Rule Syntax-->Edit--> i have used the below syntaxes and when i click Validate Rules i am getting this error.

(user.officelocation -eq "abc") -or (user.officelocation -eq "Remote, abc")

Dynamic membership rule validation error: Unsupported property.Unsupported property 'officelocation'

(user.office -eq "abc") -or (user.office -eq "Remote, abc")

Dynamic membership rule validation error: Unsupported property.Unsupported property 'office'
Yuki Sun-MSFT 37,366 Reputation points

2023-11-01T05:39:14.42+00:00

Hi @Rising Flight ,

I'm writing to check if your issue has been resolved. If the problem is successfully resolved, you can share your solution or accept post you find helpful as answer. This can be beneficial to others who reading this thread. If you need further assistance on this, please feel free to post back. Thanks!
Sandeep G-MSFT 11,331 Reputation points Microsoft Employee

2023-11-02T09:51:29.71+00:00

@Rising Flight

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread.
JamesTran-MSFT 34,226 Reputation points Microsoft Employee

2023-11-08T23:37:07.05+00:00

@Rising Flight

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Rich Matheisen 43,076 Reputation points

2023-10-27T20:09:25.0833333+00:00

Do you really mean that you want to create a unified group? Or do you want to create a Dynamic Distribution group that will allow you to send email to one group whose membership includes users from locations "abc" and "abc, remote"?

Those are two different types of groups, and a unified group can exist only in the cloud service.
Rising Flight 3,161 Reputation points

2023-10-28T01:02:49.3933333+00:00

i have created unified group-->In Azure AD for the group properties-->Membership type: Dynamic User-->Add dynamic query Rule Syntax-->Edit--> i have used the below syntaxes and when i click Validate Rules i am getting this error.

(user.officelocation -eq "abc") -or (user.officelocation -eq "Remote, abc")

Dynamic membership rule validation error: Unsupported property.Unsupported property 'officelocation'

(user.office -eq "abc") -or (user.office -eq "Remote, abc")

Dynamic membership rule validation error: Unsupported property.Unsupported property 'office'
Yuki Sun-MSFT 37,366 Reputation points

2023-11-01T05:39:14.42+00:00

Hi @Rising Flight ,

I'm writing to check if your issue has been resolved. If the problem is successfully resolved, you can share your solution or accept post you find helpful as answer. This can be beneficial to others who reading this thread. If you need further assistance on this, please feel free to post back. Thanks!
Sandeep G-MSFT 11,331 Reputation points Microsoft Employee

2023-11-02T09:51:29.71+00:00

@Rising Flight

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread.
JamesTran-MSFT 34,226 Reputation points Microsoft Employee

2023-11-08T23:37:07.05+00:00

@Rising Flight

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 1

Rich Matheisen 43,076

I don't see "officelocation" or "office" in the list of acceptable property names here: https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership

Answer 2

Hi @Rising Flight ,

I want pull users with office location abc and abc, remote.

Based on my test, office location field is corresponding to the property "physicalDeliveryOfficeName".
User's image

So, I‘d recommend using the syntax below instead:

(user.physicalDeliveryOfficeName -eq "abc") -or (user.physicalDeliveryOfficeName -eq "Remote, abc") -or (user.physicalDeliveryOfficeName -eq "abc, Remote")

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in [our documentation] to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

@Rising Flight

Thank you for posting this in Microsoft Q&A.

As Rich Matheisen mentioned, there is no "officelocation" or "office" attributes which are shown for dynamic group rules.

https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership

I have checked this in my lab and when we pull the user properties from Azure AD, I found that Office location attribute is set in Azure AD as user attribute "physicalDeliveryOfficeName".

To filter users with office location you will have to use the "user.physicalDeliveryOfficeName -eq "value"" in your rule that you create.

You can use the rule as below and this should work for you,

(user.physicalDeliveryOfficeName -eq "abc") -or (user.physicalDeliveryOfficeName -eq "Remote, abc") -or (user.physicalDeliveryOfficeName -eq "abc, Remote")

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Rich Matheisen 43,076 Reputation points

2023-10-30T14:52:47.7933333+00:00

Microsoft has "simplified" in their cmdlets many property names in the AD to make it more convenient for admins. However, the attribute name in the AD for the "Office" property is physicalDeliveryOfficeName. The cmdlets just "translate" them for you. However, the Azure AD isn't the Active Directory.

Before the advent of PowerShell, writing code to manage the AD had to be done in languages like VB and Perl using ADSI and COM objects where there was no such simplification.

dynamic membership rule

3 answers

Activity