Microsoft 365 Users
Rule description
This rule queries Microsoft 365 user accounts based on the specified filters and criteria. You can:
Limit the user scope to a specific administrative Entra ID unit.
Customize query parameters to return only the required users.
When to use this rule
Use this rule to retrieve a specific set of Microsoft 365 users. Other rules can use it as a foundation for various automation scenarios.
To explore all available rule templates related to Microsoft 365 users, search for "Microsoft 365 users" in the Add Rule wizard.
This rule is particularly useful in the following scenarios:
When you need a list of users in Microsoft 365.
When you need to filter Microsoft 365 users from a CSV file.
When you need full control over query parameters.
Query section
| Setting name | Description |
|---|---|
| General Settings | |
Limit scope to this Azure AD Administrative Unit |
This setting defines the search query scope. To improve query performance, limit the scope to a specific Entra ID administrative unit. IMPORTANT: To test the rule configuration, limit the rule scope to an administrative unit that contains test accounts or objects. |
|
Query criteria
|
Query criteria are sent with the query and may improve query performance. TIP: For additional information on the criteria builder, see the How to use Query Builder dialog for Query Criteria and Filter rule settings. |
|
Post-query filter
|
To hide unwanted data based on criteria, not supported by the Microsoft 365 query criteria above, set the filtering conditions here. TIP: For optimal performance, use the Query criteria above to filter objects whenever possible. |
Properties to display |
Each object property defined in this setting matches the column that will be displayed in the Web Portal for this web query. To display additional columns, add the required properties to the Properties to display list. To add extension attribute 1 that is synchronized from AD, you need to use a value like:
Copy
|
User account properties | |
Account state |
Specify account state:
|
User type |
Specify user type:
|
Account sync status |
Specify account sync status:
|
Modern MFA status |
Specify modern MFA status:
IMPORTANT: Due to the current nature of the Microsoft API that returns this information, users will be processed one by one by this MFA status post-filter. Expect 10 minutes of processing per every 300 returned users if this filter is enabled. Reduce the number of users by using query criteria to reduce the rule execution time. |
Administrator role |
Specify administrator role:
|
Date time properties | |
Minimum account age (hours) |
Specify the minimum account age for the Microsoft 365 user accounts. |
Maximum account age (hours) |
Specify the maximum account age for the Microsoft 365 user accounts. |
Last Microsoft 365 sign in (days ago) |
Set a minimum number of days past since a user signs in to Microsoft 365. Use 0 to disable this check. NOTE: Using this parameter requires an Entra ID Premium P1/P2 license in the tenant. |
Last password change (days ago) |
Set a minimum number of days past since a user changed the password. |
Last sync time (days ago) |
Set a minimum number of days past the last sync time. |
Extension Attributes | |
|
Extension attribute1 - Extension attrbute15 |
If you use Microsoft 365 extension attributes to store additional information for user accounts, you could select these attributes and map them to Other Attributes. |
Mailbox and Licensing filters | |
Mailbox type |
Specify mailbox type:
|
Include licensed users |
Specify which users should be included:
|
Filter by licenses |
You can filter users by assigned licenses and apps/services: License filter conditions are split into two groups: filter by licenses and filter by apps/services. Licenses can be filtered by ALL, ANY, and NOT:
Apps/services filter conditions:
Also, you can add filtering by inheritance of assigned applications and services:
|
Organization Properties | |
|
Specify organization properties for search. |
Map to text file | |
Select data source |
Specify the text file to be imported. The […] (three dots) button allows the user to browse for the file and the Create/Edit button allows the creation or editing of the existing file in the built-in Data Source editor. |
Separator used in file |
Specify the separator used in the source CSV file. |
Data source anchor attribute |
Select a column in the data source that contains the attribute value for identifying and mapping a computer. |
System anchor attribute |
Specify user anchor attribute. |
Other Query Settings | |
System properties |
List of properties required for this rule to be executed correctly. |
Sort by |
Sort result objects list. |
Limit result set |
This setting is used to optimize performance by limiting the number of objects returned by the Microsoft Graph API. Unlike query criteria, any post-filters on the returned objects are applied after they are returned, which means that the final set of returned objects could be less than the number configured here despite these objects existing in the source system. |
MS Graph query condition (OData) |
By default, Query criteria are used. But when the MS Graph query condition is specified, it overrides the Query criteria setting. See this article for examples: How to use Query Builder dialog for Query Criteria and Filter rule settings. |
MS Graph advanced queries |
Enables consistency level eventually which uses an index that might not be up-to-date with recent changes to the object. |
Initialization script | |
Script |
Usually, rules use query criteria to limit the query search scope. It improves the performance of the executed rule. Due to the PowerShell limitations, it is not possible to use calculated expressions in query criteria. That is the point where the initialization script can help. You can initialize a global variable in this setting and then use it in query criteria. IMPORTANT: To use a variable, declared in the initialization script, in the query scope, it must be global: Example: Update AD users, created in the last ten days.
|
Output Section
This section defines the output format of this rule.
To get more information about this section, please see the Rule Output section article.
Enforce/Schedule Section
This section defines the schedule for how often to run the rule.
To get more information about this section, please see the Rule Enforce/Schedule section article.
Comments
0 comments
Please sign in to leave a comment.