Dynamic membership rules

[Sk-73]

Dear all,

May I know how to add expression rules into our Dynamic group in order to remove those inactive users? The current workaround is, to change the group type to the assigned group type, remove the inactive user, and then change it back to a dynamic group.

Will be grateful for any help you can provide.

Thanks.

[#2]

Hi,

It depends on how you mark a user as inactive. I hope those users are disabled. So you can use the expression:

user.accountEnabled -eq false

All other available options are defined in the following Microsoft blog

https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership

Please let me know if this fix your problem. Or please let us know how you mark users as inactive.

Kind regards,

René

[#3]

Hi @Mr_Helaas Thank you! I will try again and let you know. Cheers

[#4]

Hi @Mr_Helaas is it possible can filter those users who are already blocking sign in?

[#5]

Hi,

If you click on block sign in, the user will be disabled in azure ad and you can use the expression that I have posted in precious comment to filter them out.

Kind regards,

René

[#6]

Hi @Mr_Helaas ,

Thank you! Please see the below attached. Is it correct?

[#7]

You could use the validate rule to determine if the user that was disabled (blocked sign in) shows up

[#8]

Hi @Rudy_Ooms_MVP Thanks!

Just now I created a disaster :face_with_tears_of_joy:
Luckily my Infra manager quickly finds out and change the rules for me.
Before was user.accountEnabled -eq false     filter those enable user
Now is        user.accountEnabled -eq true      filter those disabled users
Anyway, we have managed to set it up correctly now. Thank you, guys!