Defining dynamic group member rules for including only external guests: which syntax is valid?

Question

&nbsp;&nbsp;The syntax is really starting to confuse me as I thought this should work . However, I tend to work with internal users so this may not work.&nbsp;(user.userPrincipalName -contains "@guestdomain.co.uk")&nbsp;My colleague reckons this is the answer&nbsp;(user.usermail -contains "@guestdomain.co.uk")&nbsp;Or his latest suggestion,&nbsp;(user.userType -eq "Guest") and (user.otherMails -contains "@guestdomain.co.uk")&nbsp;Normally, I would inspect the AAD but I don't have permissions to AD on the target tenant. Anyway, would be great to stop us both arguing with a proven answer!&nbsp;&nbsp;

hidmov · Accepted Answer

Hi&nbsp;Daniel Westerdale&nbsp;&nbsp;The Syntax we use to get all external guests is:&nbsp;(user.userType -eq "Guest")&nbsp;This will pick out all of the guest users in the tenant regardless of their domain. If you just want all guest users from a specific domain, then you can filter by domain with this syntax&nbsp;(user.mail -contains "@company.co.uk")&nbsp;Just tested both in my tenant and and confirm either way works 👍&nbsp;One weird bug I found I noticed - when assigning members via user.mail they didn't show up in the new AAD groups preview, but did in the old view. &nbsp;Hope this helps,Mark&nbsp;

Forum Discussion

Defining dynamic group member rules for including only external guests: which syntax is valid?

Share

Resources