Articles in this section

See more
Print

Microsoft 365 Users | Add to Azure AD Administrative Units rule

  • Updated
Follow

Rule description

This rule queries the selected Microsoft 365 users' scope and for each returned user, finds the corresponding cloud account and adds it to the selected Azure AD Administrative Unit, either directly or dynamically via text file mapping.

Note: Privileged Role Administrator is required to add Microsoft 365 users to Azure AD Admin Units if a Microsoft 365 connection account doesn't have a Global Admin role.  

 

When to use this rule

Use this rule to return a specific set of Microsoft 365 users and add them to the specified Azure AD Administrative Unit either directly or dynamically via text file (CSV) mapping. You can use the template CSV file provided with the rule, or create a file in Microsoft Excel and export it as CSV.

 

Query Section

Setting name Description
General Settings  

Limit scope to this Azure AD Administrative Unit

This setting defines the search query scope.

To improve query performance, limit the scope to a specific Azure Admin Unit.

Important: To test rule configuration, limit the rule scope to an Azure Admin Unit that contains test accounts or objects.

Query criteria

 

Query criteria are sent with the query and may improve query performance.

Tip: For different samples on the criteria builder, see KB20180410-1.

Post-query filter

 

To hide unwanted data based on criteria, not supported by the Microsoft 365 query criteria above, set the filtering conditions here.

Tip: For optimal performance, use the Query criteria above to filter objects whenever possible.

Properties to display

To display additional properties for each object found by the query, add those properties to the list.

User account properties

  

Account state

Specify account state:

  1. Any
  2. Enabled
  3. Disabled

User type

Specify user type:

  1. Any 
  2. Member
  3. Guest

Account sync status

Specify account sync status:

  1. Any
  2. Synced
  3. Cloud-only

Modern MFA status

Specify modern MFA status:

  1. Any
  2. Configured
  3. Not configured
Important: Due to the current nature of the Microsoft API that returns this information, users will be processed one by one by this MFA status post-filter. Expect 10 minutes of processing per every 300 returned users if this filter is enabled. Reduce the number of users by using query criteria to reduce the rule execution time.

Administrator role

Specify administrator role:

  1. Any
  2. Global Administrator

Date time properties

  

Minimum account age (hours)

 Specify the minimum account age for the Microsoft 365 user accounts.

Maximum account age (hours)

 Specify the minimum account age for the Microsoft 365 user accounts.

Last Microsoft 365 sign in (days ago) 

Set a minimum number of days past since a user signs in to Microsoft 365. Use 0 to disable this check.

Note: Using this parameter requires an Azure AD Premium P1/P2 license in the tenant.

Last password change (days ago)

 Set a minimum number of days past since a user changed the password.

Last sync time (days ago)

 Set a minimum number of days past the last sync time. 

Extension Attributes 

  

Extension attribute1 - Extension attrbute15

If you use Microsoft 365 extension attributes to store additional information for user accounts, you could select these attributes and map them to Other Attributes.

To set labels or default values for these attributes, please use Attribute Policies. 

Mailbox and Licensing filters

  

Mailbox type 

Specify mailbox type:

  1. Do not filter
  2. Any mailbox
  3. No mailbox
  4. User
  5. Shared
  6. Room
  7. Equipment

Include licensed users

Specify which users should be included:

  1. All users
  2. Licensed users only
  3. Unlicensed users only

Filter by licenses

You can filter users by assigned licenses and apps/services:

  1. License filter conditions are split into two groups: filter by licenses and filter by apps/services.
  2. Licenses can be filtered by ALL, ANY, and NOT:
    1. ALL - user must have all listed licenses assigned
    2. ANY - user must have at least one listed license assigned
    3. NOT - user must not have any listed licenses assigned.
  3. Apps/services filter conditions: ENABLED (all specified) and DISABLED (all specified):
    1. ENABLED (all specified) - user must have all listed apps/services
    2. DISABLED (all specified) - user must not have all listed apps/services.

Also, you can add filtering by inheritance of assigned applications and services:

  1. Filter by direct or inherited (GBL) assignments
  2. Filter by direct assignments only
  3. Filter by inherited assignments (GBL).

Organization Properties

  

DisplayName/Email starts with

EmployeeID starts with

Employee type

Job Title 

Division

Cost center

Department

City

State

Country 

Postal code

Usage location

 Specify organization properties for search.

Map to text file

  

Select data source

Specifies the text file to be imported.

The […] button allows the user to browse for the file and the Create/Edit button allows the creation or editing of the existing file in the built-in Data Source editor.

Separator used in file

 Specify the separator that is used in the CSV file.

Data source anchor attribute

 Select a column in the data source that contains the attribute value for identifying and mapping a user.

System anchor attribute

 Specify user anchor attribute.

Other Query Settings

  

System properties

 List of properties required for this rule to be executed correctly.

Sort by

Sort result objects list.

Limit result set

The maximum number of users returned from Microsoft 365 by default is 2000.

Tip: It is possible to change the default value in Microsoft Microsoft 365 extension settings.

MS Graph query condition (OData)

By default, Query criteria are used. But when the MS Graph query condition is specified, it overrides the Query criteria setting.

See this article for examples: How to use Query Builder dialog for Query Criteria and Filter rule settings – Cayosoft Help Center.

MS Graph advanced queries

Enables consistency level eventually which uses an index that might not be up-to-date with recent changes to the object.

Initialization script

  

Script

Usually, rules use query criteria to limit the query search scope. It improves the performance of the executed rule.

Due to PowerShell limitations, it is not possible to use calculated expressions in query criteria. That is the point where the initialization script can help. You can initialize a global variable in this setting and then use it in query criteria.

Important: To use a variable, declared in the initialization script, in the query scope, it must be global: $global:<variable name>.

Example: Update AD users, created in the last ten days.

  1. Add this initialization script:
{$global:DatePeriod = (Get-Date).AddDays(-10)}
  1. Use $DatePeriod variable in the query criteria builder:

 

Action Section

Setting name Description
Target AU selection mode

One of these values is possible:

  1. Select a single Azure AD Administrative Unit directly from setting
  2. Select Administrative Unit dynamically based on attribute mapping in a CSV file 
Action 

Specify one of these actions:

  1. Add to Admin Unit (preserve existing membership)
  2. Move to Admin Unit (remove existing memberships in other Admin Units)
  3. Remove from Admin Unit (preserve existing memberships)
  4. Set according to Azure AD AU container configuration in Microsoft 365 extension. If the specified Admin Unit is treated as a container then users will be added to it and removed from other Admin Units. If the specified Admin Unit is not a container then users will be just added to it.
Azure AD Administrative Unit If using the 'Select a single Azure AD AU' mode above select the Azure AD administrative Unit. If using a dynamic mapping file select the CSV file column containing the Azure AD Administrative Unit name.
Dynamic Mapping from File Settings   
Data source

This setting specifies the text file for import.

The […] button allows the user to browse for the file and the Create button allows creation or editing of the file in the Cayosoft Administrator data source editor.
Separator used in file  Use this setting to select the separator used in the file.
Azure Active Directory anchor attribute

Specify cloud user attribute. For each object returned by the query, the selected attribute value will be used to map the object with the selected data source anchor.
CSV anchor match column Select the CSV column that contains the values that will be matched to the AD anchor attribute values.
Azure AD Administrative Unit column Select the CSV file column containing the Azure AD Administrative Unit name if using a dynamic mapping file. 

 

 

Output Section

This section defines the output format of this rule.

To get more information about this section, please see the Output section article.

 

Enforce/Schedule section

This section defines the schedule for how often to run the rule.

To get more information about this section, please see the Enforce/Schedule section article.

 

Change History

Version Notes
10.2.1 The rule has been added to the product.

 

Related articles

Comments

0 comments

Please sign in to leave a comment.