Recent Discussions
Entra ID Dynamic User security group - Syntax rule
Attempting to create a Dynamic user group for Microsoft consumer accounts in my B2B tenant. This should be very simple. Background data: Collection or array object - User.identities (Collection or array) - User.identities.issuer (Collection or array only when B2B guest/member) - User.identities.issuer (string when internal member) - User.identities.IssuerassignedID (Collection or array only when B2B guest/member) - User.identities.IssuerassignedID (string when internal member) - User.identities.SignInType (Collection or array only when B2B guest/member) - User.identities.SignInType (String when internal member) There seems to be ongoing issuers querying or filtering for user.identities.issuer, along with use of various filter combinations. Again, this should be very simple. I've tried multiple combinations of the below syntax rule. Does anyone have something that has worked for you? (user.identities -any (objectIdentity.issuer -eq "MicrosoftAccount")) -and (user.identities -any (objectIdentity.issuerAssignedId -eq null)) (user.identities -any (objectIdentity.issuer -any (_ -eq "MicrosoftAccount")) -and (user.identities -any (objectIdentity.issuerAssignedId (_ -eq null))) (user.identities -any (issuer -any (_ -eq "MicrosoftAccount")) -and (user.identities -any (issuerAssignedId (_ -eq null)))
How to exclude security group members using dynamic query
Hi, I'm trying to build a dynamic query for a security group and want to exclude members of a certain group in this. Example- Let's say there's a security group A and I'm building a new security group B and I want to exclude members of group A to be added to this group B. I'm struggling to find the right query for this. Any ideas?
Dynamic AD group
Hi Experts I am using exchange hybrid environment, all my users are created on onprem and migrated to cloud. for example i have user1 whose department number is 100, every user has department number in AD attribute. i have another user whose department number is 101. my requirement is to add these users to office365 unified group dynamically, i.e user whose department number is 100 or 101 should be added to this office365 group dynamically and if tomorrow employee leaves the company it should be removed automatically,or is it possible to create a dynamic group in Azure AD to pull the members of department 100 and 101 and add this group to office365 unified group. Experts guide me on this.
employeeType attribute for Dynamic Group features
Dear Microsoft, I would like to suggest the feature of Dynamic Groups to support the employeeType attribute. As dynamic groups are used by features like Identity Governance Auto-Assignment policies and could be the base for Conditional Access Policies, this feature would be aligned with the Secure Futures Initiatives and the Conditional Access Policy Architecture implementation recommendation using various personas (Conditional Access architecture and personas - Azure Architecture Center | Microsoft Learn) as well as the Microsoft Recommendation not to use extensionAttributes for purposes other than a Hybrid Exchange deployment, as well as having Named Attributes for such important security configurations and Entitlement Management. Thanks, B
Dynamic group membership rules stopped working
We've been using the following the following dynamic membership rule to check if a user is a member of another group: user.memberOf -any (group.objectId -in ['2b930be6-f46a-4a70-b1b5-3e4e0c483fbf']) The group is an Active Directory group that is represented in Entra with the stated Entra group object Id. The validation fails for every user and looks like this: It seems that all out dynamic groups are affected and stopped working. Have you seen this before? Thanks.Unwanted MFA Method Options Displayed During Login
We have DUO configured and enforced as an MFA provider via an external authentication setup. However, during the login process, users are still being presented with additional method options, including: • Email (Receive a code to reset password) • Hardware token (Sign in with a code from a hardware token) • Phone (Call or text) • Microsoft Authenticator We want to remove at minimum the Email and Hardware token options from being shown, as these are not approved methods in our security policy. They are shown as disabled in Entra with the screenshots provided. What’s been done: • DUO is configured as an external authentication method • An exemption group has been added in Azure AD Authentication Methods policy to exclude users from using SMS and Microsoft Authenticator, yet users are still prompted to set up another authentication method during login We are in the process of transitioning users over to DUO so still need to have Microsoft authenticator as an option, but want users who are configured to use the DUO authentication method to not require another formUnwanted MFA Method Options Displayed During Login
Description: We have DUO configured and enforced as the sole MFA provider via an external authentication setup. However, during the login process, users are still being presented with additional method options, including: • Email (Receive a code to reset password) • Hardware token (Sign in with a code from a hardware token) • Phone (Call or text) • Microsoft Authenticator We want to remove at minimum the Email and Hardware token options from being shown, as these are not approved methods in our security policy. What’s been done: • DUO is configured as the default and only intended MFA method. • An exemption group has been added in Azure AD Authentication Methods policy to exclude users from using SMS and Microsoft Authenticator, yet users are still prompted to set up another authentication method during login We are in the process of transitioning users over to DUO so still need to have Microsoft authenticator as an option, but want users who are configured to use the DUO authentication method to not require another formFido passkeys blocked by policy
Hi all I'm helping out a customer with deploying physical passkeys and I'm running into a weird error. I've activated the sign in method and selected the two AAGuids for the Authenticator app and I've added the right AAGuid for the brand and model of passkey we are using. We can select the authentication method and enroll the security correctly but when trying to sign in using it we get the error as displayed in the attached picture. When checking the sign in logs i get this error message FIDO sign-in is disabled via policy and the error code is: 135016 I've not been able to track down any policy that would be blocking passkeys. anyone got any ideas?Users Cannot Change Passwords – Conditional Access Blocking Office 365 Portal (Non-Admin Scenario)
Hi everyone, I’m encountering an issue with Conditional Access that I’d like some input on. 🛑 The Problem: Users are unable to change their passwords (e.g., using Ctrl + Alt + Del on Windows) because access to the Office 365 Portal is blocked by our Conditional Access configuration. The error message states: Access has been blocked by Conditional Access policiesTarget app: Office 365 Portal (App ID: 00000006-0000-0ff1-ce00-000000000000) According to Microsoft documentation, this portal is not classified as an admin portal, yet access is being blocked. ⚙️ The Configuration: We have a Conditional Access policy that: Targets all users Excludes admin accounts Applies to Microsoft Admin Portals Action: Block access This setup worked as designed for preventing users from accessing admin portals — admins can access, users are blocked. However, now when regular users attempt to change their passwords, they seem to trigger access to the Microsoft 365 Portal, which is getting blocked by the policy. ❓ My Questions: Why is the Office 365 Portal (non-admin) being affected by a policy scoped only to admin portals? Is there a recommended exception or configuration change that allows users to perform password changes securely without lifting the block on admin portals? Could this be related to how Microsoft identifies the portal/app in the Conditional Access policy backend? Any insights or experiences with similar setups would be greatly appreciated! Thanks in advance for your help.
Am trying to create group with dynamic user membership using attribute "Employee Type"
Am trying to create group with dynamic user membership using attribute "Employee Type", tried to get details from Extension attribute but didn't find any option, Did anyone tried this and able to do ? I found a posting where it said to create a custom attribute that would be populated by the 'employee Type' field. That just seems a little strange to me to to create an attribute to be exactly like the one that is already there.
Enabling JIT Access for Managed Identities through PIM - Possible?
Hello, Azure Community, I'm exploring the capabilities of Privileged Identity Management (PIM) and have encountered a scenario where I'm seeking guidance. Scenario: I have a managed identity that requires various permissions, which should be granted through group assignments. My goal is to utilize PIM for Just-In-Time (JIT) assignment of these permissions to enhance security and minimize the attack surface by limiting the time these elevated permissions are available. Question: Is there a known method to enable JIT assignments for a managed identity through PIM? Specifically, I'm looking to understand if it's possible for me as a user to activate JIT assignments on behalf of the managed identity. If this approach isn't feasible, is there an alternative strategy that would achieve similar outcomes in terms of assigning managed identities to groups or roles just in time? Cheers folks!
Access On Premise Apps Using Entra Identity
I plan to switch to using Microsoft 365 using a new domain from my on-premise email. There are several on-premise applications that are accessed using on-premise identity with the old domain. For one reason or another, I have not been able to change these applications to use the new domain. I am confused, will I still be able to access my on-premise applications using Identity Entra with the new domain.Entra Private Access: Location awareness- GSA Client
Hi there, I’ve recently started researching Entra Private Access, and it looks promising. However, one thing I have noticed in various online discussions is that the GSA client installed on end-user machines isn't location aware. That is, even when a user is working from the office, the client continues to tunnel traffic, which results in added latency. Technically speaking, if an end user is in the office, the client should automatically detect this and disable itself. Unfortunately, this doesn't seem to be the case with the current GSA client. So, does anyone—especially from the Entra Team—know if there are any plans to include a feature that mitigates this issue in the future? Thanks, Article: Entra Private Access - disable when on-prem? : r/sysadmin
Lighthouse - viewing CA configuration at-a-glance
Hi, first off - apologies if I'm in the wrong space. I really do not understand the community hub structure, and there doesn't seem to be one for lighthouse. recently came across our 2nd tenant this year that did not have any CA policies set. Assuming this was just overlooked during P1 purchasing or something. Is there a way to view CA status within Lighthouse for all tenants? We do not have the full granular admin setup - our customers are sub-tenants but only just. We have domain admins for each, but our personal accounts do not have Security Admin roles on them. Saying this because it locks me out of some Lighthouse features. But trying to find a way to check this easily. Thanks
RDP Issue when connecting to remote client
Has anyone else experienced an issue where they are connecting to a remote client through Microsoft secure access and it takes multiple (between 5 and 10 ) times to get the connect to prompt for credentials? I am part of a team and my 2 other colleagues on different machines are having the exact same issue with connecting via rdp to a remote desktop.Warning: PIM disconnects users from Teams Mobile
I have been working with Microsoft Support on this issue for three months. Hopefully I can save others the trouble. Sometime around April 2024, I and my colleagues started seeing regular alerts on our mobile devices saying "Open Teams to continue receiving notifications for <email address>", or "<email address> needs to sign in to see notifications". Just as promised, after this message appears, we do not get notified about messages and Teams calls do not ring on our mobile devices until we open Teams. We eventually determined that these alerts coincided with activating or deactivating PIM roles. Apparently, a change was made to Privileged Identity Management in Microsoft Entra ID around that time whereby users' tokens are invalidated when a role is activated or deactivated. Quoting the Microsoft Support rep: "When a user's role changes (either due to activation or expiration), Skype AAD[?] will revoke existing tokens of that users. Skype AAD will also notify PNH about that token revocation. This is expected behavior and is working as designed. These changes were rolled out in Skype AAD in April/May 2024 which is since when you are facing the issue as well." Anyway, as far as I can tell, this change was not announced or documented anywhere, so hopefully this message will show up in the search results of my fellow admins who are dealing with this.Graph API for Entra App Launchers
Hi, We are currently rolling out hundreds of App Proxy apps and want to use the MyApps portal as a dynamic Start Menu for our users. For now there is a possibility to manually add apps to App Launchers for users to click on, but i cannot find any possibility to do this using any sort of pipeline or automation. Is there somebody over here that has managed to add Applications to App Launchers / Categories programmatically ? And if yes, can you please share how? Kind regards, René
Recent Blogs
- Learn how Golden SAML attacks work and discover strategies to protect your identity infrastructure.Jun 05, 2025
- Secure Score Recommendations from Microsoft Defender are now available in Entra Recommendations.Jun 04, 2025
