Skip to content

Commit a33514d

Browse files
committed
PM feedback
1 parent f0e3786 commit a33514d

File tree

1 file changed

+19
-24
lines changed

1 file changed

+19
-24
lines changed

articles/active-directory/enterprise-users/groups-dynamic-rule-streamline.md

Lines changed: 19 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ ms.service: active-directory
99
ms.subservice: enterprise-users
1010
ms.workload: identity
1111
ms.topic: overview
12-
ms.date: 03/25/2022
12+
ms.date: 03/29/2022
1313
ms.author: curtand
1414
ms.reviewer: jordandahl
1515
ms.custom: it-pro
@@ -26,58 +26,53 @@ The team for Azure Active Directory (Azure AD) sees numerous incidents related t
2626

2727
Minimize the usage of the 'match' operator in rules as much as possible. Instead, explore if it's possible to use the `contains`, `startswith`, or `-eq` operators. Considering using other properties that allow you to write rules to select the users you want to be in the group without using the `-match` operator. For example, if you want a rule for the group for all users whose city is Lagos, then instead of using rules like:
2828

29-
```powershell
30-
user.city -match "ago" or user.city -match ".*?ago.*"
31-
```
29+
- `user.city -match "ago"`
30+
- `user.city -match ".*?ago.*"`
3231

3332
It's better to use rules like:
3433

35-
`user.city -contains "ago,"` or
36-
`user.city -startswith "Lag,"` or
37-
best of all, `user.city -eq "Lagos"`
34+
- `user.city -contains "ago,"`
35+
- `user.city -startswith "Lag,"`
36+
37+
Or, best of all:
38+
39+
- `user.city -eq "Lagos"`
3840

3941
## Use fewer OR operators
4042

4143
In your rule, identify when it uses various values for the same property linked together with `-or` operators. Instead, use the `-in` operator to group them into a single criterion to make the rule easier to evaluate. For example, instead of having a rule like this:
4244

43-
```powershell
45+
```
4446
(user.department -eq "Accounts" -and user.city -eq "Lagos") -or
4547
(user.department -eq "Accounts" -and user.city -eq "Ibadan") -or
4648
(user.department -eq "Accounts" -and user.city -eq "Kaduna") -or
4749
(user.department -eq "Accounts" -and user.city -eq "Abuja") -or
4850
(user.department -eq "Accounts" -and user.city -eq "Port Harcourt")
4951
```
5052

51-
it's better to have a rule like this:
53+
It's better to have a rule like this:
54+
55+
- `user.department -eq "Accounts" -and user.city -in ["Lagos", "Ibadan", "Kaduna", "Abuja", "Port Harcourt"]`
5256

53-
```powershell
54-
user.department -eq "Accounts" -and user.city -in ["Lagos", "Ibadan", "Kaduna", "Abuja", "Port Harcourt"]
55-
```
5657

5758
Conversely, identify similar sub criteria with the same property not equal to various values, that are linked with `-and` operators. Then use the `-notin` operator to group them into a single criterion to make the rule easier to understand and evaluate. For example, instead of using a rule like this:
5859

59-
```powershell
60-
(user.city -ne "Lagos") -and (user.city -ne "Ibadan") -and (user.city -ne "Kaduna") -and (user.city -ne "Abuja") -and (user.city -ne "Port Harcourt")
61-
```
60+
- `(user.city -ne "Lagos") -and (user.city -ne "Ibadan") -and (user.city -ne "Kaduna") -and (user.city -ne "Abuja") -and (user.city -ne "Port Harcourt")`
6261

6362
It's better to use a rule like this:
6463

65-
```powershell
66-
user.city -notin ["Lagos", "Ibadan", "Kaduna", "Abuja", "Port Harcourt"]
67-
```
64+
- `user.city -notin ["Lagos", "Ibadan", "Kaduna", "Abuja", "Port Harcourt"]`
6865

6966
## Avoid redundant criteria
7067

7168
Ensure that you aren't using redundant criteria in your rule. For example, instead of using a rule like this:
7269

73-
```powershell
74-
user.city -eq "Lagos" or user.city -startswith "Lag"
75-
```
70+
- `user.city -eq "Lagos" or user.city -startswith "Lag"`
71+
7672
It's better to use a rule like this:
7773

78-
```powershell
79-
user.city -startswith "Lag"
80-
```
74+
- `user.city -startswith "Lag"`
75+
8176

8277
## Next steps
8378

0 commit comments

Comments
 (0)