Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
SOLVED

Creating dynamic groups with custom attribute

Brass Contributor

We want to create several groups based on the value that we fill into the field CustomAttribute1. 

 

Our environment is not AD Synced. We're working in the cloud with all our applications and services.

When we check the value of the attributes in the Exchange Admin Center, everything is filled in correctly. But our groups are not filled with members, and there is no error.

 

Why are our groups not populated with users?

10 Replies

@Viktor Hedberg 

 

Hello,

this rule is very simple: (user.extensionAttribute1 -eq "xxxxxxxxxxxxx")

 


@Viktor Hedberg wrote:

@Johan Pauly Hi, how are your rules for the dynamic groups set up? 

 

https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership




 

Hi again,

Just to be clear. Are we talking about Dynamic Azure AD Groups or Dynamic Distribution Groups?

/Viktor

@Viktor Hedberg 

 

It's about Dynamic Azure AD Groups.

best response confirmed by Johan Pauly (Brass Contributor)
Solution
Yeah, right. The ExtensionAttribute you are referring to is present on the Exhange Mailbox?

Azure AD dynamic group rules does not as to my knowledge let you use Exchange Extension Attributes from out-of-the box.

Since you also stated that there is no AAD Connect Sync in place, I would try another attribute. The ExtensionAttributes reffered to in https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership... are those coming from on-prem AD via sync.
That is also what I thought. But I was not sure about it.
As your said, these ExtensionAttributes are present on the Exchange mailbox. About using another attribute, it's difficult. We want to use a specific value to populate these groups.
Thanks for your answers.

Hello,

 

you can use custom properties for membership of dynamic azure ad groups without on permises AD sync.
However, these custom properties are not the ones you can set in EAC!

Despite them being called "onPremisesExtensionAttributes", you can use them without ad sync.

The rules you can make with them for dynamic azure AD group membership, are much more powerful than the EAC custom attributes (which you can use only for dynamic distribution groups, not for azure ad dynamic groups), you'll like it!


The recommended way to get/set these properties is using ms graph (as far as I could find out, there exists a - more complex - way for setting them with powershell,  but I could find no way to retrieve them with powershell).

To get these custom  properties (and check there's no on premises sync):

GET https://graph.microsoft.com/v1.0/users/<id< a=""> or principa</id<>l name>?$select=onPremisesSyncEnabled,onPremisesExtensionAttributes

If there's no on premises sync, onPremisesSyncEnabled is null (if onPremisesSyncEnabled is true, the...

 

If onPremisesSyncEnabled is null or false, you can set them like this :

PATCH https://graph.microsoft.com/v1.0/users/<id< a=""> or principal name></id<>

with a request body like this :

{
 "onPremisesExtensionAttributes": {
     "extensionAttribute1": "any string you like",
     "extensio...














 

You can test the above requests in graph explorer (https://developer.microsoft.com/en-us/graph/graph-explorer).

 

More info here: https://docs.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0

and here: https://docs.microsoft.com/en-us/graph/api/resources/onpremisesextensionattributes?view=graph-rest-1...

 

 

Best regards,

 

Tom

My post above appearded a little screwed up, hope the commands will be readable this time:

 

getting:

GET https://graph.microsoft.com/v1.0/users/id_or_<id< a="">principa</id<>lname_here?$select=onPremisesSyncEnabled,onPremisesExtensionAttributes

 

setting:

PATCH https://graph.microsoft.com/v1.0/users/id_or_<id< a="">principa</id<>lname_here

with  a request body like this:

{
     "onPremisesExtensionAttributes": {
          "extensionAttribute1": "any string you want",
          "extensionAttribute2": "some other string",
          "extensionAttribute3": null,
          "extensionAttribute4": null,
          "extensionAttribute5": null,
          "extensionAttribute6": null,
          "extensionAttribute7": null,
          "extensionAttribute8": null,
          "extensionAttribute9": null,
          "extensionAttribute10": null,
          "extensionAttribute11": null,
          "extensionAttribute12": null,
          "extensionAttribute13": null,
          "extensionAttribute14": null,
          "extensionAttribute15": null
     }
}

Hi,
Sorry I jump to this discussion maybe later, but I've some interrogation about Extensionattributes.
As i was said previously attributes are by default sync from OnPremiseAD. But it's possible to exclude them from the AAD sync process.
I'd like to use few of them and manage their value from AAD.

Idea is to push some Information grab on MSOL account and Mail box activity (thourgh graph and automation process).
At the end I want to use 2 attribute to store nb of inactivity days, then Identify Sleeping accounts on another other attributes when Account inactive more than 30 days.
Both of this attribute will be used in Dynamic Group rule to define membership.

=> is it possible to stop Synchronization of an attribute, then mange this in AAD side only? Or will it be possible to manage them from exchange online Powershell?
1 best response

Accepted Solutions
best response confirmed by Johan Pauly (Brass Contributor)
Solution
Yeah, right. The ExtensionAttribute you are referring to is present on the Exhange Mailbox?

Azure AD dynamic group rules does not as to my knowledge let you use Exchange Extension Attributes from out-of-the box.

Since you also stated that there is no AAD Connect Sync in place, I would try another attribute. The ExtensionAttributes reffered to in https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership... are those coming from on-prem AD via sync.

View solution in original post