Rule description
This rule queries the selected AD groups' scope and for each returned group, finds the corresponding cloud group by SID and then adds it to the selected Azure AD Administrative Unit.
When to use this rule
Use this rule to return a specific set of Microsoft 365 groups and add them to the specified Azure AD Administrative Unit either directly or dynamically via text file (CSV) mapping. You can use the template CSV file provided with the rule, or create a file in Microsoft Excel and export it as CSV.
Query Section
Setting name | Description |
---|---|
General Settings | |
Limit scope to this Azure AD Administrative Unit |
This setting defines the search query scope. To improve query performance, limit the scope to a specific Azure Admin Unit. Important: To test rule configuration, limit the rule scope to an Azure Admin Unit that contains test accounts or objects.
|
Query criteria
|
Query criteria are sent with the query and may improve query performance. Tip: For different samples on the criteria builder, see KB20180410-1.
|
Post-query filter
|
To hide unwanted data based on criteria, not supported by the Microsoft 365 query criteria above, set the filtering conditions here. Tip: For optimal performance, use the Query criteria above to filter objects whenever possible.
|
Group type |
Specify the Microsoft 365 group type:
|
Properties to display |
To display additional properties for each object found by the query, add those properties to the list. Loading certain additional properties such as member count will decrease rule performance. |
Group type filters |
|
Membership type |
Specify membership type:
|
Group sync status |
Specify group sync status:
|
Privacy |
Specify privacy:
Note: Applies only to Microsoft 365 type groups. Limiting group privacy uses a post-filter and will decrease the rule performance. Please note that group privacy can be set only during group creation.
|
Group search filters |
|
DisplayName starts with Mail starts with
|
Specify group properties for search. |
Classification equals |
Specify group classification. Note: Classification is searched by classic Azure AD classification values.
|
Number of members less than or equal to |
Filtering by the number of members requires loading per group properties and will decrease rule performance if used. |
Number of owners less than or equal to |
Filtering by the number of owners requires loading per group user properties and will decrease rule performance if used. |
Date time filters | |
Minimum group age (hours) | Specify the minimum age in hours for the Microsoft 365 groups. Will return groups older than specified hours. 0 returns all groups. Uses a post filter which will affect the rule performance. |
Maximum group age (hours) | Specify the maximum age in hours for the Microsoft 365 groups. Will return groups older than specified hours. Uses a post filter which will affect the rule performance. |
Expiration date (days until) | Will return groups set to expire within specified days. |
Last renew date (days ago) | Will return groups whose last expiration renewal date happened the specified (or more) days ago. Uses a post filter which will affect the rule performance. |
Last sync time (days ago) | Will return groups last synced the specified (or more) days ago. Cloud-only groups that were never synced are excluded. Uses a post filter which will affect the rule performance. |
Licensing Filters | |
Licensed groups | Will return groups that have assigned licenses and are used for Group-based licensing. Uses a post filter which will affect the rule performance. |
Map to text file | |
Select data source |
Specifies the text file to be imported. The […] button allows the user to browse for the file and the Create/Edit button allows the creation or editing of the existing file in the built-in Data Source editor. |
Separator used in file | Specify the separator that is used in the CSV file. |
Data source anchor attribute | Select a column in the data source that contains the attribute value for identifying and mapping a group. |
System anchor attribute | Specify group anchor attribute. |
Other Query Settings | |
System properties | List of properties required for this rule to be executed correctly. |
Sort by | Sort result objects list. |
Limit result set |
This setting is used to optimize performance by limiting the number of objects returned by the Microsoft Graph API. Unlike query criteria, any post-filters on the returned objects are applied after they are returned, which means that the final set of returned objects could be less than the number configured here despite these objects existing in the source system. |
MS Graph query condition (OData) |
By default, Query criteria are used. But when the MS Graph query condition is specified, it overrides the Query criteria setting. See this article for examples: How to use Query Builder dialog for Query Criteria and Filter rule settings – Cayosoft Help Center. |
MS Graph advanced queries | Enables consistency level eventually which uses an index that might not be up-to-date with recent changes to the object. |
Initialization script | |
Script |
Usually, rules use query criteria to limit the query search scope. It improves the performance of the executed rule. Due to PowerShell limitations, it is not possible to use calculated expressions in query criteria. That is the point where the initialization script can help. You can initialize a global variable in this setting and then use it in query criteria. Important: To use a variable, declared in the initialization script, in the query scope, it must be global: $global:<variable name>.
Example: Update AD users, created in the last ten days.
{$global:DatePeriod = (Get-Date).AddDays(-10)}
|
Action Section
Setting name | Description |
---|---|
Target AU selection mode |
One of these values is possible:
|
Action |
Specify one of these actions:
|
Azure AD Administrative Unit | If using the 'Select a single Azure AD AU' mode above select the Azure AD administrative Unit. If using a dynamic mapping file select the CSV file column containing the Azure AD Administrative Unit name. |
Dynamic Mapping from File Settings | |
Data source |
This setting specifies the text file for import. The […] button allows the user to browse for the file and the Create button allows creation or editing of the file in the Cayosoft Administrator data source editor. |
Separator used in file | Use this setting to select the separator used in the file. |
Azure Active Directory anchor attribute |
Specify cloud group attribute. For each object returned by the query, the selected attribute value will be used to map the object with the selected data source anchor. |
CSV anchor match column | Select the CSV column that contains the values that will be matched to the AD anchor attribute values. |
Azure AD Administrative Unit column | Select the CSV file column containing the Azure AD Administrative Unit name if using a dynamic mapping file. |
Output Section
This section defines the output format of this rule.
To get more information about this section, please see the Output section article.
Enforce/Schedule section
This section defines the schedule for how often to run the rule.
To get more information about this section, please see the Enforce/Schedule section article.
Change History
Version | Notes |
---|---|
10.2.1 | The rule has been added to the product. |
Comments
0 comments
Please sign in to leave a comment.