This setting defines the search query scope. To improve query performance, limit the scope to a specific Entra ID administrative unit.

IMPORTANT: To test the rule configuration, limit the rule scope to an administrative unit that contains test accounts or objects.

Query criteria are sent with the query and may improve query performance.

TIP: For additional information on the criteria builder, see the How to use Query Builder dialog for Query Criteria and Filter rule settings.

To hide unwanted data based on criteria, not supported by the Microsoft 365 query criteria above, set the filtering conditions here.

TIP: For optimal performance, use the Query criteria above to filter objects whenever possible.

Each object property defined in this setting matches the column that will be displayed in the Web Portal for this web query.

To display additional columns, add the required properties to the Properties to display list.

To add extension attribute 1 that is synchronized from AD, you need to use a value like:

"OnPremisesExtensionAttributes/extensionAttribute1~Extension Attribute 1"

Specify the account state:

• Any

• Enabled

• Disabled

Specify the user type:

• Any

• Member

• Guest

Specify the account sync status:

• Any

• Synced

• Cloud only

Specify the modern MFA status:

• Any

• Configured

• Not configured

Specify the administrator role assigned to the user:

• Any

• Global Administrator

NOTE: Use the ... picker to define a custom filter by using existing roles in your organization.

Set a minimum number of days passed since a user sign-in to Microsoft 365. Use 0 to disable the setting.

NOTE: Using this parameter requires an Entra ID Premium P1/P2 license in the tenant.

If you use Microsoft 365 extension attributes to store additional information for user accounts, you could select these attributes and map them to Other Attributes.

Learn more in: How to add custom attributes to New Object and Object Properties wizards in Web Portal.

Specify the mailbox type:

• Any mailbox

• No mailbox

• User

• Shared

• Room

• Equipment

• Do not filter

Specify the users to be included:

• All users

• Licensed users only

• Unlicensed users only

You can filter users by assigned licenses and apps/services:

License filter conditions are split into two groups: filter by licenses and filter by apps/services.

Licenses can be filtered by ALL, ANY, and NOT:

• ALL - user must have all listed licenses assigned

• ANY - user must have at least one listed license assigned

• NOT - user must not have any listed licenses assigned.

Apps/services filter conditions:

• ENABLED (all specified) and DISABLED (all specified):

• ENABLED (all specified) - user must have all listed apps/services

• DISABLED (all specified) - user must not have all listed apps/services.

Also, you can add filtering by inheritance of assigned applications and services:

• Filter by direct or inherited (GBL) assignments

• Filter by direct assignments only

• Filter by inherited assignments (GBL).

Specify the text file to be imported.

The […] (three dots) button allows the user to browse for the file and the Create/Edit button allows the creation or editing of the existing file in the built-in Data Source editor.

Specify the maximum number of users returned from Microsoft 365. The default limit is 2000.

TIP: It is possible to change the default value in the Microsoft 365 extension settings.

By default, Query criteria are used. But when the MS Graph query condition is specified, it overrides the Query criteria setting.

See this article for examples: How to use Query Builder dialog for Query Criteria and Filter rule settings.

Enables consistency level eventually which uses an index that might not be up-to-date with recent changes to the object.