AD Users M365 Authentication Methods (MFA) Status rule

Limit AD scope to this domain or OU

This setting defines the search query scope.

To improve query performance, limit the scope to specific OU.

Query criteria

Microsoft 365 query criteria

Query criteria are sent with the query and may improve query performance.

Post-query filter

Microsoft 365 filter

To hide unwanted data based on criteria, not supported by the Active Directory and Microsoft 365 query criteria above, set the filtering conditions here.

Example: Filter by the found object Distinguished Name.

Exclude MS365 disabled users

This setting allows you to exclude Microsoft 365 disabled users from the rule scope or to include them.

Exclude AD disabled users

This setting allows you to exclude AD-disabled users from the rule scope or to include them.

Other Query Settings

Properties to display

To display additional Microsoft 365 properties for each object found by the query, add those properties to the list.

System properties

Sort by

Sort result objects list.

Limit result set

The maximum number of users returned from Microsoft 365 by default is 2000.

MS Graph query condition (OData)

By default, Query criteria are used. But when the MS Graph query condition is specified, it overrides the Query criteria setting.

See this article for examples: How to use Query Builder dialog for Query Criteria and Filter rule settings – Cayosoft Help Center.

Initialization script

Script

Usually, rules use query criteria to limit the query search scope. It improves the performance of the executed rule.

Due to PowerShell limitations, it is not possible to use calculated expressions in query criteria. That is the point where the initialization script can help. You can initialize a global variable in this setting and then use it in query criteria.

Example: Update AD users, created in the last ten days.

1. Add this initialization script:

{$global:DatePeriod = (Get-Date).AddDays(-10)}

2. Use $DatePeriod variable in query criteria builder: