You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/enterprise-users/groups-dynamic-rule-streamline.md
+19-24Lines changed: 19 additions & 24 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.service: active-directory
9
9
ms.subservice: enterprise-users
10
10
ms.workload: identity
11
11
ms.topic: overview
12
-
ms.date: 03/25/2022
12
+
ms.date: 03/29/2022
13
13
ms.author: curtand
14
14
ms.reviewer: jordandahl
15
15
ms.custom: it-pro
@@ -26,58 +26,53 @@ The team for Azure Active Directory (Azure AD) sees numerous incidents related t
26
26
27
27
Minimize the usage of the 'match' operator in rules as much as possible. Instead, explore if it's possible to use the `contains`, `startswith`, or `-eq` operators. Considering using other properties that allow you to write rules to select the users you want to be in the group without using the `-match` operator. For example, if you want a rule for the group for all users whose city is Lagos, then instead of using rules like:
28
28
29
-
```powershell
30
-
user.city -match "ago" or user.city -match ".*?ago.*"
31
-
```
29
+
-`user.city -match "ago"`
30
+
-`user.city -match ".*?ago.*"`
32
31
33
32
It's better to use rules like:
34
33
35
-
`user.city -contains "ago,"` or
36
-
`user.city -startswith "Lag,"` or
37
-
best of all, `user.city -eq "Lagos"`
34
+
-`user.city -contains "ago,"`
35
+
-`user.city -startswith "Lag,"`
36
+
37
+
Or, best of all:
38
+
39
+
-`user.city -eq "Lagos"`
38
40
39
41
## Use fewer OR operators
40
42
41
43
In your rule, identify when it uses various values for the same property linked together with `-or` operators. Instead, use the `-in` operator to group them into a single criterion to make the rule easier to evaluate. For example, instead of having a rule like this:
Conversely, identify similar sub criteria with the same property not equal to various values, that are linked with `-and` operators. Then use the `-notin` operator to group them into a single criterion to make the rule easier to understand and evaluate. For example, instead of using a rule like this:
0 commit comments