This setting defines the search query scope. To improve query performance, limit the scope to a specific OU.

IMPORTANT: To test the rule configuration, limit the rule scope to an OU that contains test accounts or objects and use the Preview feature.

Query criteria are sent with the query and may improve query performance.

TIP: For additional information on the criteria builder, see the How to use Query Builder dialog for Query Criteria and Filter rule settings.

Set the filtering conditions to hide unwanted data based on criteria not supported in the Query criteria setting.

Example: filter by the found object Distinguished Name.

TIP: For optimal performance, use the Query criteria setting above to filter objects whenever possible.

Each object property defined in this setting matches the column that will be displayed in the Web Portal for this web query.

To display additional columns, add the required properties to the Properties to display list.

To add extension attribute 1 that is synchronized from AD, you need to use a value like:

"OnPremisesExtensionAttributes/extensionAttribute1~Extension Attribute 1"

Select account state:

• Any;

• Enabled;

• Disabled.

Specify user type:

• Any 

• Member
  

• Guest

Specify account sync status:

• Any

• Synced

• Cloud-only

Specify modern MFA status:

• Any

• Configured - a user has at least one authentication method configured.

• Not configured - a user doesn't have any authentication methods configured.

IMPORTANT: Due to the current nature of the Microsoft API that returns this information, users will be processed one by one by this MFA status post-filter. Expect 10 minutes of processing per every 300 returned users if this filter is enabled. Reduce the number of users by using query criteria to reduce the rule execution time.

Specify administrator role:

• Any

• Global Administrator

• Or select a specific Administrator role from the picker dialog.

Set a minimum number of days past since a user signs in to Microsoft 365. Use 0 to disable this check.

NOTE: Using this parameter requires an Azure AD Premium P1/P2 license in the tenant.

If you use Microsoft 365 extension attributes to store additional information for user accounts, you could select these attributes and map them to Other Attributes.

Specify mailbox type:

• Do not filter

• Any mailbox

• No mailbox

• User

• Shared

• Room

• Equipment

Specify which users should be included:

• All users

• Licensed users only

• Unlicensed users only

You can filter users by assigned licenses and apps/services:

License filter conditions are split into two groups: filter by licenses and filter by apps/services.

Licenses can be filtered by ALL, ANY, and NOT:

• ALL - user must have all listed licenses assigned

• ANY - user must have at least one listed license assigned

• NOT - user must not have any listed licenses assigned.

Apps/services filter conditions:

• ENABLED (all specified) and DISABLED (all specified):

• ENABLED (all specified) - user must have all listed apps/services

• DISABLED (all specified) - user must not have all listed apps/services.

Also, you can add filtering by inheritance of assigned applications and services:

• Filter by direct or inherited (GBL) assignments

• Filter by direct assignments only

• Filter by inherited assignments (GBL).

Specify the text file to be imported.

The […] (three dots) button allows the user to browse for the file and the Create/Edit button allows the creation or editing of the existing file in the built-in Data Source editor.

Specify the separator used in the source CSV file.

Select a column in the data source that contains the attribute value for identifying and mapping a computer.

List of properties required for this rule to be executed correctly.

Sort result object list.

The maximum number of users returned from Microsoft 365 by default is 2000.

TIP: It is possible to change the default value in Microsoft 365 extension settings.

By default, Query criteria are used. But when the MS Graph query condition is specified, it overrides the Query criteria setting.

See this article for additional information: How to use Query Builder dialog for Query Criteria and Filter rule settings.

Usually, rules use query criteria to limit the query search scope. It improves the performance of the executed rule.

Due to the PowerShell limitations, it is not possible to use calculated expressions in query criteria. That is the point where the initialization script can help. You can initialize a global variable in this setting and then use it in query criteria.

IMPORTANT: To use a variable, declared in the initialization script, in the query scope, it must be global: $global:<variable name>.

Example: Update AD users, created in the last ten days.

1. Add this initialization script

   Copy

   {$global:DatePeriod = (Get-Date).AddDays(-10)}

2. Use the $DatePeriod variable in the query criteria builder: