Articles in this section

See more
Print

Microsoft 365 Groups and Members rule

  • Updated
Follow

Rule description

This is a generic rule to query for Microsoft 365 groups and members based on the specified query criteria and filters. You can limit group scope to a specific Azure AD Admin Unit and set the query criteria to return only the required groups and members.

 

When to use this rule

Use this rule to return a specific set of Microsoft 365 groups and members. Other rules may use this rule as a basis to accomplish many typical scenarios. Each of these rules can be configured to query for Microsoft 365 groups and members and then perform some task against those groups. Please, search for the "Microsoft 365 groups" keyword on the Add Rule wizard to see the list of all available rule templates that query for Microsoft 365 groups.

The Microsoft 365 Groups rule is useful in these three main scenarios:

  • When you need a list of groups and members in Microsoft 365.
  • When you need to filter Microsoft 365 groups and members from the CSV file.
  • When you need full control over query parameters.

 

Query Section

Setting name Description
General Settings  

Limit scope to this Azure AD Administrative Unit

This setting defines the search query scope.

To improve query performance, limit the scope to a specific Azure Admin Unit.

Important: To test rule configuration, limit the rule scope to an Azure Admin Unit that contains test accounts or objects.

Query criteria

 

Query criteria are sent with the query and may improve query performance.

Tip: For different samples on the criteria builder, see KB20180410-1.

Post-query filter

 

To hide unwanted data based on criteria, not supported by the Microsoft 365 query criteria above, set the filtering conditions here.

Tip: For optimal performance, use the Query criteria above to filter objects whenever possible.

Group type

Specify the Microsoft 365 group type:

  1. All Microsoft 365 groups (Unified)
  2. Teams
  3. Distribution lists
  4. Mail-enabled security groups
  5. Security groups
  6. All Mail-enabled
  7. Microsoft 365 groups without Teams
  8. Microsoft 365 groups with security enabled

Properties to display

To display additional properties for each object found by the query, add those properties to the list. Loading certain additional properties such as member count will decrease rule performance.

Members settings 

  

Properties to display (members)

 To display additional properties for each object found by the query, add those properties to the list. Loading certain additional properties such as member count will decrease rule performance.

Members type

Specify members type:

  1. Direct members 
  2. Transitive members
  3. Owners

Member sync status

Specify user sync status:

  1. Any
  2. Cloud-only
  3. Synced 

Member type

Specify user type:

  1. Any 
  2. Member users
  3. Guest users
  4. All users
  5. Groups
  6. Devices
  7. Service principals 

Members query criteria

 Query criteria are sent to the target platform with other query parameters to reduce the number of objects returned.

Post-query filter

To hide unwanted data based on criteria, not supported by the Microsoft 365 query criteria above, set the filtering conditions here.

Tip: For optimal performance, use the Query criteria above to filter objects whenever possible.

Group type filters

  
Membership type

Specify membership type:

  1. Dynamic 
  2. Directly assigned
Group sync status

Specify group sync status:

  1. Synced
  2. Cloud-only
Privacy

Specify privacy:

  1. Public 
  2. Private
  3. Hidden membership
Note: Applies only to Microsoft 365 type groups. Limiting group privacy uses a post-filter and will decrease the rule performance. Please note that group privacy can be set only during group creation. 

Group search filters

  

DisplayName starts with
Description starts with

Mail starts with

 Specify group properties for search.

Classification equals

Specify group classification. 

Note: Classification is searched by classic Azure AD classification values.

Number of members less than or equal to

 Filtering by the number of members requires loading per group properties and will decrease rule performance if used.

Number of owners less than or equal to

 Filtering by the number of owners requires loading per group user properties and will decrease rule performance if used.
Date time filters  
Minimum group age (hours) Specify the minimum age in hours for the Microsoft 365 groups. Will return groups older than specified hours. 0 returns all groups. Uses a post filter which will affect the rule performance. 
Maximum group age (hours) Specify the maximum age in hours for the Microsoft 365 groups. Will return groups older than specified hours. Uses a post filter which will affect the rule performance. 
Expiration date (days until) Will return groups set to expire within specified days.
Last renew date (days ago) Will return groups whose last expiration renewal date happened the specified (or more) days ago. Uses a post filter which will affect the rule performance. 
Last sync time (days ago) Will return groups last synced the specified (or more) days ago. Cloud-only groups that were never synced are excluded. Uses a post filter which will affect the rule performance. 
Licensing Filters  
Licensed groups Will return groups that have assigned licenses and are used for Group-based licensing. Uses a post filter which will affect the rule performance. 
Map to text file  
Select data source

Specifies the text file to be imported.

The […] button allows the user to browse for the file and the Create/Edit button allows the creation or editing of the existing file in the built-in Data Source editor.
Separator used in file Specify the separator that is used in the CSV file.
Data source anchor attribute Select a column in the data source that contains the attribute value for identifying and mapping a group.
System anchor attribute Specify group anchor attribute.
Other Query Settings  
System properties List of properties required for this rule to be executed correctly.
Sort by Sort result objects list.
Limit result set

This setting is used to optimize performance by limiting the number of objects returned by the Microsoft Graph API. Unlike query criteria, any post-filters on the returned objects are applied after they are returned, which means that the final set of returned objects could be less than the number configured here despite these objects existing in the source system. 
MS Graph query condition (OData)

By default, Query criteria are used. But when the MS Graph query condition is specified, it overrides the Query criteria setting.

See this article for examples: How to use Query Builder dialog for Query Criteria and Filter rule settings – Cayosoft Help Center.
MS Graph advanced queries Enables consistency level eventually which uses an index that might not be up-to-date with recent changes to the object.
Initialization script  
Script

Usually, rules use query criteria to limit the query search scope. It improves the performance of the executed rule.

Due to PowerShell limitations, it is not possible to use calculated expressions in query criteria. That is the point where the initialization script can help. You can initialize a global variable in this setting and then use it in query criteria.

Important: To use a variable, declared in the initialization script, in the query scope, it must be global: $global:<variable name>.

Example: Update AD users, created in the last ten days.

  1. Add this initialization script:
{$global:DatePeriod = (Get-Date).AddDays(-10)}
  1. Use $DatePeriod variable in the query criteria builder:

 

Output Section

This section defines the output format of this rule.

To get more information about this section, please see the Output section article.

 

Enforce/Schedule section

This section defines the schedule for how often to run the rule.

To get more information about this section, please see the Enforce/Schedule section article.

 

Change History

Version Notes
10.1.0 The rule has been added to the product.

 

Related articles

Comments

0 comments

Please sign in to leave a comment.