AD Users with Microsoft 365 Licenses
Rule description
This hybrid rule queries Active Directory users, matches these accounts to Microsoft 365 user accounts, filters these by the specified licensing criteria and returns the resulting accounts along with their licensing details.
When to use this rule
Use this rule to get a report with Active Directory users that have Microsoft 365 accounts and are filtered by licensing criteria.
Rule settings
Query section
| Setting name | Description |
|---|---|
| General Settings | |
Limit AD scope to this domain or OU |
This setting defines the search query scope. To improve query performance, limit the scope to a specific OU. IMPORTANT: To test the rule configuration, limit the rule scope to an OU that contains test accounts or objects and use the Preview feature. |
|
Query criteria Microsoft 365 query criteria |
Query criteria are sent with the query and may improve query performance. TIP: For additional information on the criteria builder, see the How to use Query Builder dialog for Query Criteria and Filter rule settings. |
|
Filter Microsoft 365 filter |
Set the filtering conditions to hide unwanted data based on criteria not supported in the Query criteria setting. Example: filter by the found object Distinguished Name. TIP: For optimal performance, use the Query criteria setting above to filter objects whenever possible. |
Exclude MS365 disabled users |
This setting allows to exclude Microsoft 365 disabled users from the rule scope or to include them. |
Exclude AD disabled users |
This setting allows to exclude AD-disabled users from the rule scope or to include them. |
Exclude shared mailboxes |
This setting allows to exclude shared mailboxes from the rule scope or to include them. |
Include licensed users |
This setting allows to include only licensed or unlicensed users or all users. |
Filter by licenses |
You can filter users by assigned licenses and apps/services: License filter conditions are split into two groups: filter by licenses and filter by apps/services. Licenses can be filtered by ALL, ANY, and NOT:
Apps/services filter conditions:
Also, you can add filtering by inheritance of assigned applications and services:
|
Show license assignment paths |
If set to Yes the output report will include the license assignment paths: direct or inherited (GBL-assigned). |
Show service plan details |
If set to Yes the output report will include the names of all apps assigned to the user instead aggregate account. |
Show service plan status |
If set to Yes the output report will include the names and statuses of all apps assigned to the user. |
License details separator character |
The separator is used when displaying multiple licenses or apps names in a single output column. Possible separators are:
|
Include only filtered licenses in output |
If set to Yes the output report will only list those assigned licenses that were explicitly included in the filter above. |
Other Query Settings | |
Properties to display |
Each object property defined in this setting matches the column that will be displayed in the Web Portal for this web query. To display additional columns, add the required properties to the Properties to display list. To add extension attribute 1 that is synchronized from AD, you need to use a value like:
Copy
|
System properties |
List of properties required for this rule to be executed correctly. |
Sort by |
Sort result objects list. |
Maximum number of users |
By default, all objects that you have provisioned in Microsoft Office 365 are returned. TIP: It is possible to change the default value in the extension settings. |
MS Graph query condition (OData) |
By default, Query criteria are used. But when the MS Graph query condition is specified, it overrides the Query criteria setting. See this article for examples: How to use Query Builder dialog for Query Criteria and Filter rule settings. |
Initialization script | |
Script |
Usually, rules use query criteria to limit the query search scope. It improves the performance of the executed rule. Due to the PowerShell limitations, it is not possible to use calculated expressions in query criteria. That is the point where the initialization script can help. You can initialize a global variable in this setting and then use it in query criteria. IMPORTANT: To use a variable, declared in the initialization script, in the query scope, it must be global: Example: Update AD users, created in the last ten days.
|
Output section
This section defines the output format of this rule.
To get more information about this section, please see the Rule Output section article.
Enforce/Schedule section
This section defines the schedule for how often to run the rule.
To get more information about this section, please see the Rule Enforce/Schedule section article.
Comments
0 comments
Please sign in to leave a comment.