Dynamic group membership rules with application assignment

%3CLINGO-SUB%20id%3D%22lingo-sub-1599806%22%20slang%3D%22en-US%22%3EDynamic%20group%20membership%20rules%20with%20application%20assignment%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1599806%22%20slang%3D%22en-US%22%3E%3CP%3E1.%20I%20have%20a%20dynamic%20user%20group%20(Microsoft365)%26nbsp%3B%20(CRM%20users)%26nbsp%3B%20%26nbsp%3B---%20originating%20from%20random%20AD%20OUs%20or%20departments.%20where%20group%20name%20should%20be%26nbsp%3B%20%22CRM%20users.%3C%2FP%3E%3CP%3E2.%26nbsp%3B%20I%20have%20CRM%20application%26nbsp%3B%20name%20%22CRM%22%3C%2FP%3E%3CP%3E3.%20I%20want%20to%20populate%20the%20Dynamic%20group%20with%20all%20staff%20using%20this%20%22CRM%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethe%20first%20step%20i%20have%20done%3B%26nbsp%3B%3C%2FP%3E%3CP%3E-%20I%26nbsp%3B%20created%20a%20rule%26nbsp%3B%20based%20on%20department%26nbsp%3B%3CEM%3E(user.department%20-contains%20%22Medical%22)%20and%20(user.accountEnabled%20-eq%20True)%3C%2FEM%3E%20this%20works%2C%20but%20only%20for%20that%20department%3C%2FP%3E%3CP%3E-%20Now%20I%20want%20to%20assign%20users%20this%20application%2C%20then%20add%20them%20to%20dynamic%20group.%3C%2FP%3E%3CP%3ESo%20that%20all%20users%20of%20CRM%2C%20automatically%20belong%20to%20%22CRM%20users%20group%22.%3C%2FP%3E%3CP%3E___%26gt%3B%26gt%3B%26gt%3B%26nbsp%3B%3CEM%3E(user.objectId%20-ne%20NULL)%20and%20(user.accountEnabled%20-eq%20True)%20and%20(applications.applicationId%20-eq%20%2238bb468d-88ef-46d4-ad2d-8d57c1903964%22)%26nbsp%3B%20%2C%2C%2C%2C%26nbsp%3B%3C%2FEM%3Ethis%20is%20not%20working.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1599806%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAccess%20Management%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ECloud%20Essentials%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EEMS%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EIdentity%20Management%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1600538%22%20slang%3D%22en-US%22%3ERe%3A%20Dynamic%20group%20membership%20rules%20with%20application%20assignment%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1600538%22%20slang%3D%22en-US%22%3E%3CP%3Eyour%20assistance%20will%20be%20highly%20appreciated%20on%20this.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1600716%22%20slang%3D%22en-US%22%3ERe%3A%20Dynamic%20group%20membership%20rules%20with%20application%20assignment%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1600716%22%20slang%3D%22en-US%22%3E%3CP%3ENever%20seen%20the%20application%20attribute%20being%20used%2C%20are%20you%20sure%20it's%20supported%3F%20Afaik%20only%20the%20attributes%20listed%20in%20this%20article%20are%20supported%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fusers-groups-roles%2Fgroups-dynamic-membership%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fusers-groups-roles%2Fgroups-dynamic-membership%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1601964%22%20slang%3D%22en-US%22%3ERe%3A%20Dynamic%20group%20membership%20rules%20with%20application%20assignment%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1601964%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3Bhow%20can%20I%20construct%20rule%20that%20can%20allow%20application%20users%20to%20be%20members%20of%20the%20same%20group.%26nbsp%3B%20%26nbsp%3BFor%20example%3B%20accounting%20users%2C%20sales%20users%2C%20marketing%20users%2C%20IT%20users%20(not%20everyone%20in%20these%20departments%20use%20the%20app%20but%20some%20of%20them%20use%20the%20app)%2C%20I%20want%20to%20create%20for%20them%20a%20dynamic%20group.%3C%2FP%3E%3CP%3Eany%20guide%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1606642%22%20slang%3D%22en-US%22%3ERe%3A%20Dynamic%20group%20membership%20rules%20with%20application%20assignment%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1606642%22%20slang%3D%22en-US%22%3EIt's%20not%20natively%20possible.%20You%20could%20write%20a%20script%20which%20does%20this%20through%20the%20graph%20api%3C%2FLINGO-BODY%3E
Occasional Contributor

1. I have a dynamic user group (Microsoft365)  (CRM users)   --- originating from random AD OUs or departments. where group name should be  "CRM users.

2.  I have CRM application  name "CRM"

3. I want to populate the Dynamic group with all staff using this "CRM"

 

the first step i have done; 

- I  created a rule  based on department (user.department -contains "Medical") and (user.accountEnabled -eq True) this works, but only for that department

- Now I want to assign users this application, then add them to dynamic group.

So that all users of CRM, automatically belong to "CRM users group".

___>>> (user.objectId -ne NULL) and (user.accountEnabled -eq True) and (applications.applicationId -eq "38bb468d-88ef-46d4-ad2d-8d57c1903964")  ,,,, this is not working.

 

 

4 Replies

your assistance will be highly appreciated on this. 

Never seen the application attribute being used, are you sure it's supported? Afaik only the attributes listed in this article are supported: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership

@Vasil Michev how can I construct rule that can allow application users to be members of the same group.   For example; accounting users, sales users, marketing users, IT users (not everyone in these departments use the app but some of them use the app), I want to create for them a dynamic group.

any guide?

It's not natively possible. You could write a script which does this through the graph api